[Buildroot] [PATCH] package/python-django: security bump to version 3.0.12
Peter Korsgaard
peter at korsgaard.com
Tue Feb 2 15:34:54 UTC 2021
>>>>> "Peter" == Peter Korsgaard <peter at korsgaard.com> writes:
> Fixes the following security issues:
> CVE-2021-3281: Potential directory-traversal via archive.extract()
> The django.utils.archive.extract() function, used by startapp --template and
> startproject --template, allowed directory-traversal via an archive with
> absolute paths or relative paths with dot segments.
> For details, see the advisory:
> https://www.djangoproject.com/weblog/2021/feb/01/security-releases/
> Additionally, 3.0.11 fixed a regression:
> https://docs.djangoproject.com/en/3.1/releases/3.0.11/
> Update indentation in hash file (two spaces).
> Signed-off-by: Peter Korsgaard <peter at korsgaard.com>
Committed, thanks.
--
Bye, Peter Korsgaard
More information about the buildroot
mailing list