CVS commit: pkgsrc/www/py-django2

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Apr 20 12:28:57 UTC 2022

Modified Files:
        pkgsrc/www/py-django2: Makefile distinfo

Log Message:
py-django2: updated to 2.2.28

Django 2.2.28 fixes two security issues with severity “high” in 2.2.27.

CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and extra()

QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these 
methods.

CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL

QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument.


To generate a diff of this commit:
cvs rdiff -u -r1.42 -r1.43 pkgsrc/www/py-django2/Makefile
cvs rdiff -u -r1.39 -r1.40 pkgsrc/www/py-django2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django2/Makefile
diff -u pkgsrc/www/py-django2/Makefile:1.42 pkgsrc/www/py-django2/Makefile:1.43
--- pkgsrc/www/py-django2/Makefile:1.42 Wed Feb  2 10:17:19 2022
+++ pkgsrc/www/py-django2/Makefile      Wed Apr 20 12:28:57 2022
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.42 2022/02/02 10:17:19 adam Exp $
+# $NetBSD: Makefile,v 1.43 2022/04/20 12:28:57 adam Exp $
 
-DISTNAME=      Django-2.2.27
+DISTNAME=      Django-2.2.28
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django2/distinfo
diff -u pkgsrc/www/py-django2/distinfo:1.39 pkgsrc/www/py-django2/distinfo:1.40
--- pkgsrc/www/py-django2/distinfo:1.39 Wed Feb  2 10:17:19 2022
+++ pkgsrc/www/py-django2/distinfo      Wed Apr 20 12:28:57 2022
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.39 2022/02/02 10:17:19 adam Exp $
+$NetBSD: distinfo,v 1.40 2022/04/20 12:28:57 adam Exp $
 
-BLAKE2s (Django-2.2.27.tar.gz) = 6acf7763f3a10c05d2aef04d1342c9da238e1a63fe3829e3694946f5bbe53a0f
-SHA512 (Django-2.2.27.tar.gz) = 0db670651a820b49d855e38a336c0c6990ce4701bb686c5e8a292ccb03342e995c61c2c628b1d625d2715404e969fc31c256e5bf0fd6c1ff714d1c1c1ee30bff
-Size (Django-2.2.27.tar.gz) = 9185716 bytes
+BLAKE2s (Django-2.2.28.tar.gz) = 5ea76cca148513c4af6a38d1ed05bff2674dac53492a8b85b10c4be79709c4d7
+SHA512 (Django-2.2.28.tar.gz) = 228aec6ee8619ff3d0397ff867bd59352900fb95557bd02cfea594b3bc3f813b5bcd13f488b451b0ee79a4d52deab19c5e97aa40f1075ba06db72542d119228e
+Size (Django-2.2.28.tar.gz) = 9187543 bytes