CVS commit: pkgsrc/www/py-django3

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Feb 14 09:50:16 UTC 2023

Modified Files:
        pkgsrc/www/py-django3: Makefile distinfo

Log Message:
py-django: update to 3.2.18.

===========================
Django 3.2.18 release notes
===========================

*February 14, 2023*

Django 3.2.18 fixes a security issue with severity "moderate" in 3.2.17.

CVE-2023-24580: Potential denial-of-service vulnerability in file uploads
=========================================================================

Passing certain inputs to multipart forms could result in too many open files
or memory exhaustion, and provided a potential vector for a denial-of-service
attack.

The number of files parts parsed is now limited via the new
:setting:`DATA_UPLOAD_MAX_NUMBER_FILES` setting.

===========================
Django 3.2.17 release notes
===========================

*February 1, 2023*

Django 3.2.17 fixes a security issue with severity "moderate" in 3.2.16.

CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers
===========================================================================

The parsed values of ``Accept-Language`` headers are cached in order to avoid
repetitive parsing. This leads to a potential denial-of-service vector via
excessive memory usage if large header values are sent.

In order to avoid this vulnerability, the ``Accept-Language`` header is now
parsed up to a maximum length.


To generate a diff of this commit:
cvs rdiff -u -r1.30 -r1.31 pkgsrc/www/py-django3/Makefile
cvs rdiff -u -r1.29 -r1.30 pkgsrc/www/py-django3/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django3/Makefile
diff -u pkgsrc/www/py-django3/Makefile:1.30 pkgsrc/www/py-django3/Makefile:1.31
--- pkgsrc/www/py-django3/Makefile:1.30 Fri Nov 18 06:00:20 2022
+++ pkgsrc/www/py-django3/Makefile      Tue Feb 14 09:50:16 2023
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.30 2022/11/18 06:00:20 adam Exp $
+# $NetBSD: Makefile,v 1.31 2023/02/14 09:50:16 wiz Exp $
 
-DISTNAME=      Django-3.2.16
+DISTNAME=      Django-3.2.18
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:tl}
 CATEGORIES=    www python
 MASTER_SITES=  https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/

Index: pkgsrc/www/py-django3/distinfo
diff -u pkgsrc/www/py-django3/distinfo:1.29 pkgsrc/www/py-django3/distinfo:1.30
--- pkgsrc/www/py-django3/distinfo:1.29 Fri Nov 18 06:00:20 2022
+++ pkgsrc/www/py-django3/distinfo      Tue Feb 14 09:50:16 2023
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.29 2022/11/18 06:00:20 adam Exp $
+$NetBSD: distinfo,v 1.30 2023/02/14 09:50:16 wiz Exp $
 
-BLAKE2s (Django-3.2.16.tar.gz) = 32b7e8638cb5f1c1fcd1ab39c12f2172aaf393c368875533a0c8255f0fbf0b81
-SHA512 (Django-3.2.16.tar.gz) = 628263370b4d073d5e88db8607f5b082b03c4e6e6ed6aca059dce18f61725eb4ff69da77f5f98ff7b3e6d9046a701aca5a32687670bf7ea5fdcf92d6d13d7373
-Size (Django-3.2.16.tar.gz) = 9847052 bytes
+BLAKE2s (Django-3.2.18.tar.gz) = 9d8085c04044fdc95ee1149eef9fabcf4e7c27bbeeaa443394f2d892c851106d
+SHA512 (Django-3.2.18.tar.gz) = dbcf8daa4edf3666bfcb366b09e1c3de12a4176770ab2e6cd22b459ff77aa4cdbd72c445f53e7b23a907f663dc37b07c15d5d0d67e63fdec98eb4832dcc57d6d
+Size (Django-3.2.18.tar.gz) = 9848949 bytes