CVS commit: pkgsrc/www/py-django4

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Aug  6 20:13:11 UTC 2024

Modified Files:
        pkgsrc/www/py-django4: Makefile distinfo

Log Message:
py-django4: updated to 4.2.15

Django 4.2.15 fixes three security issues with severity “moderate”, one security issue with severity “high”, and a regression in 4.2.14.

CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat()

If floatformat received a string representation of a number in scientific notation with a large exponent, it could lead to significant memory consumption.

To avoid this, decimals with more than 200 digits are now returned as is.

CVE-2024-41990: Potential denial-of-service vulnerability in django.utils.html.urlize()

urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.

CVE-2024-41991: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget

urlize, urlizetrunc, and AdminURLFieldWidget were subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.

CVE-2024-42005: Potential SQL injection in QuerySet.values() and values_list()

QuerySet.values() and values_list() methods on models with a JSONField were subject to SQL injection in column aliases, via a crafted JSON object key as a passed *arg.

Bugfixes

Fixed a regression in Django 4.2.14 that caused a crash in LocaleMiddleware when processing a language code over 500 characters


To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 pkgsrc/www/py-django4/Makefile \
    pkgsrc/www/py-django4/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django4/Makefile
diff -u pkgsrc/www/py-django4/Makefile:1.5 pkgsrc/www/py-django4/Makefile:1.6
--- pkgsrc/www/py-django4/Makefile:1.5  Thu Jul 11 18:52:42 2024
+++ pkgsrc/www/py-django4/Makefile      Tue Aug  6 20:13:11 2024
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.5 2024/07/11 18:52:42 adam Exp $
+# $NetBSD: Makefile,v 1.6 2024/08/06 20:13:11 adam Exp $
 
-DISTNAME=      Django-4.2.14
+DISTNAME=      Django-4.2.15
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/
Index: pkgsrc/www/py-django4/distinfo
diff -u pkgsrc/www/py-django4/distinfo:1.5 pkgsrc/www/py-django4/distinfo:1.6
--- pkgsrc/www/py-django4/distinfo:1.5  Thu Jul 11 18:52:42 2024
+++ pkgsrc/www/py-django4/distinfo      Tue Aug  6 20:13:11 2024
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.5 2024/07/11 18:52:42 adam Exp $
+$NetBSD: distinfo,v 1.6 2024/08/06 20:13:11 adam Exp $
 
-BLAKE2s (Django-4.2.14.tar.gz) = 14af6fd8c35a6e6a65d3ddfa1eb964c3ad76b51c5528cab20ee28070353ae7d1
-SHA512 (Django-4.2.14.tar.gz) = 2663454c48f57a441d1620faad30ac25750d1e71bf34eddbdef3e6d8dd208913752ab657447ffea5e9d3a0676a4a4d501fa88a40a0ca0fd361df0782a6b3306b
-Size (Django-4.2.14.tar.gz) = 10432993 bytes
+BLAKE2s (Django-4.2.15.tar.gz) = 4f37e3255d8a48a44177e44e5f3f4d42f0f17e59d8634eb9d8a9a208be40200e
+SHA512 (Django-4.2.15.tar.gz) = 8f334dcaa36b3bce5184ddf1a1508bf42614be6ab486c9e0d87e9bfd212511c43081ad5fb02d2dd7b54f8236fc1f7ee9cd7b7f6f94ac8edc1cb52d1c0c698880
+Size (Django-4.2.15.tar.gz) = 10418066 bytes