diff options
| author | Stefan Ghinea <stefan.ghinea@windriver.com> | 2021-04-23 11:53:56 +0800 |
|---|---|---|
| committer | Armin Kuster <akuster808@gmail.com> | 2021-04-23 19:09:37 -0700 |
| commit | aef354a0c29a4c6aad4ace53190b5573c78d881b (patch) | |
| tree | 16619557f5a84aed41b769f40650a8f6c395928a /meta-python/recipes-devtools/python/python3-jsonpointer | |
| parent | e2aef4022af4f3a622892ed4f52961e120202324 (diff) | |
| download | meta-openembedded-aef354a0c29a4c6aad4ace53190b5573c78d881b.tar.gz | |
python3-django: fix CVE-2021-28658
In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8,
MultiPartParser allowed directory traversal via uploaded files with
suitably crafted file names. Built-in upload handlers were not affected
by this vulnerability.
References:
https://nvd.nist.gov/vuln/detail/CVE-2021-28658
Upstream patches:
https://github.com/django/django/commit/4036d62bda0e9e9f6172943794b744a454ca49c2
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Trevor Gamblin <trevor.gamblin@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'meta-python/recipes-devtools/python/python3-jsonpointer')
0 files changed, 0 insertions, 0 deletions