Changelog
python-django (1:1.11.10-1ubuntu1) bionic; urgency=low
* Merge from Debian unstable. Remaining changes:
- debian/patches/pymysql-replacement.patch: Use pymysql as drop in
replacement for MySQLdb.
- debian/control: Drop python-mysqldb in favor of python-pymysql.
python-django (1:1.11.10-1) unstable; urgency=medium
* New upstream security release:
- CVE-2018-6188: A regression in Django 1.11.8 made
django.contrib.auth.forms.AuthenticationForm run its
confirm_login_allowed() method even if an incorrect password is entered.
This can leak information about a user, depending on what messages
confirm_login_allowed() raises. If confirm_login_allowed() isn't
overridden, an attacker enter an arbitrary username and see if that user
has been set to is_active=False. If confirm_login_allowed() is
overridden, more sensitive details could be leaked.
* Use HTTPS "Format" URI in debian/copyright.
-- Steve Langasek <email address hidden> Fri, 23 Feb 2018 11:56:40 -0800
