From 660e62b64531df16c616668747a68b9a62774fbf Mon Sep 17 00:00:00 2001 From: Stefan Ghinea Date: Fri, 16 Apr 2021 18:24:17 +0300 Subject: python3-django: fix CVE-2021-28658 In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability. References: https://nvd.nist.gov/vuln/detail/CVE-2021-28658 Upstream patches: https://github.com/django/django/commit/4036d62bda0e9e9f6172943794b744a454ca49c2 Signed-off-by: Stefan Ghinea Signed-off-by: Khem Raj Signed-off-by: Trevor Gamblin --- meta-python/recipes-devtools/python/python3-django_2.2.16.bb | 2 ++ 1 file changed, 2 insertions(+) (limited to 'meta-python/recipes-devtools/python/python3-django_2.2.16.bb') diff --git a/meta-python/recipes-devtools/python/python3-django_2.2.16.bb b/meta-python/recipes-devtools/python/python3-django_2.2.16.bb index 0715abbd4c..eb626e8d3f 100644 --- a/meta-python/recipes-devtools/python/python3-django_2.2.16.bb +++ b/meta-python/recipes-devtools/python/python3-django_2.2.16.bb @@ -7,3 +7,5 @@ SRC_URI[sha256sum] = "62cf45e5ee425c52e411c0742e641a6588b7e8af0d2c274a27940931b2 RDEPENDS_${PN} += "\ ${PYTHON_PN}-sqlparse \ " +SRC_URI += "file://CVE-2021-28658.patch \ +" -- cgit v1.2.3-54-g00ecf