[IT-SecNots] [SECURITY] [DSA 3230-1] django-markupfield security update

[Alessandro Ghedini <ghedo AT debian.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3230-1                   security AT debian.org
http://www.debian.org/security/                        Alessandro Ghedini
April 20, 2015                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : django-markupfield
CVE ID         : CVE-2015-0846

James P. Turk discovered that the ReST renderer in django-markupfield,
a custom Django field for easy use of markup in text fields, didn't
disable the ..raw directive, allowing remote attackers to include
arbitrary files.

For the stable distribution (wheezy), this problem has been fixed in
version 1.0.2-2+deb7u1.

For the upcoming stable distribution (jessie), this problem has been
fixed in version 1.2.1-2+deb8u1.

For the unstable distribution (sid), this problem has been fixed in
version 1.3.2-1.

We recommend that you upgrade your django-markupfield packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVNMGsAAoJEK+lG9bN5XPLWcQP/2Qf5DXMNxmhmkJX68HjQQqe
iCus9VNice9FhkQet8oYkCLFfFcHRD1ifnVtRVs14fxnuh2DrjhVceaHJnGPnUs9
xJOLxHcRnDPlqeh+NlwZKIjSMFcZHtat6FnO9Tc2V6mmWBhWPv3f5ZJkpJeLqqgW
KFxT2T1nTHTKXvjwxD2NbL3eUXic1N5gyI6FtG22//IfX32ECTHUkoHlqtlYj29M
AcB5LTQcsQLMd8QVaox1ldhkYw+wOi6Jav0VBdjCDOn+FXpeUc+EqAugZrUfz/5H
rzx2EyWWzzUy6cnQXrM1U1X7xt5WLHfjmL3ZOVmNWNUwDh3F4YIkmMR8tMcebmVg
qRo44Hng0aDU9HsCp5Gp2gepipTlz7YtKUpcNlyj99BzNIXtyNyB6SY1wQ7Hb5/f
7Ak1RKbpfnx+krioAsu0eTLv8EKYcXLu8ma2YMmy9iI8JabCIto7JwNxqbDV0hUa
7ETcS9iGrFbINzICC3si7TeQ6/DdqKIAf8F0ozQvadQM8s0jOVCLP30ovWdIDuvh
6wHkmBJ0BCm+J0NnRXe3cZABTEhkUvRHZ1Z0BZOueEfn6HLfDX6B5VPAf3pbvfa3
QiyidqZ/9JMRZjH9q2kGM2b9uSp0SVKwsusq8YlefnH5pCvXfmRta4sqptbJkw/f
O1nsdS56lZFhtyrbp7Gg
=hRsD
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to debian-security-announce-REQUEST AT lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster AT lists.debian.org
Archive: 20150420090709.5077052F AT bendel.debian.org">https://lists.debian.org/20150420090709.5077052F AT bendel.debian.org