python-django (2:3.2.6-1) [PTS] [DDPO]

OLD: VCS is behind the version in the archive: 2:2.2.24-1 < 2:3.2.6-1.

Git: https://salsa.debian.org/python-team/packages/python-django.git
Enter a full Vcs-* header, supported schemes are: Vcs-Bzr, Vcs-Cvs, Vcs-Darcs, Vcs-Git, Vcs-Hg, Vcs-Mtn, Vcs-Svn.
For Vcs-Git append -b branch to select the branch name; append [subdir] if the debian/ directory is not in the repository root.
The next upload will reset the information from the source package headers.
Branch: debian/sid
Path: debian/changelog
Browser: https://salsa.debian.org/python-team/packages/python-django
Last scan: 2021-08-02 15:16:06+00
Next scan: 2021-08-10 02:22:00+00

Debian changelog in Git:

python-django (2:2.2.24-1) unstable; urgency=medium

  * New upstream security release. (Closes: #989394)

    - CVE-2021-33203: Potential directory traversal via admindocs

      Staff members could use the admindocs TemplateDetailView view to
      check the existence of arbitrary files. Additionally, if (and only
      if) the default admindocs templates have been customized by the
      developers to also expose the file contents, then not only the
      existence but also the file contents would have been exposed.

      As a mitigation, path sanitation is now applied and only files
      within the template root directories can be loaded.

      This issue has low severity, according to the Django security
      policy.

      Thanks to Rasmus Lerchedahl Petersen and Rasmus Wriedt Larsen from
      the CodeQL Python team for the report.

    - CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks
      since validators accepted leading zeros in IPv4 addresses

      URLValidator, validate_ipv4_address(), and
      validate_ipv46_address() didn't prohibit leading zeros in octal
      literals. If you used such values you could suffer from
      indeterminate SSRF, RFI, and LFI attacks.

      validate_ipv4_address() and validate_ipv46_address() validators
      were not affected on Python 3.9.5+.

      This issue has medium severity, according to the Django security
      policy.

 -- Chris Lamb <lamby@debian.org>  Wed, 02 Jun 2021 16:15:13 +0100

This branch is even with tag debian/2%2.2.24-1