Django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes to prevent web cache poisoning. A further security fix has been issued recently such that parse_qsl() no longer allows using ; as a query parameter separator by default (CVE-2021-23336). . MGASA-2021-0135 - Updated python-django package fixes a security vulnerability Publication date: 14 Mar 2021 URL: https://advisories.mageia.org/MGASA-2021-0135.html Type: security Affected Mageia releases: 8 CVE: CVE-2021-23336 Django contains a copy of urllib.parse.parse_qsl() which was added to backport some security fixes to prevent web cache poisoning. A further security fix has been issued recently such that parse_qsl() no longer allows using ; as a query parameter separator by default (CVE-2021-23336). References: - https://bugs.mageia.org/show_bug.cgi?id=28395 - https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ - https://ubuntu.com/security/notices/USN-4742-1 - https://www.cve.org/CVERecord?id=CVE-2021-23336 SRPMS: - 8/core/python-django-3.1.7-1.mga8 . The latest python-django update releases essential corrections addressing a web cache poison vulnerability, while also reinforcing overall security protocols.. Python Django Security Update, Mageia Advisory, Web Cache Protection, Urllib Fixes. . LinuxSecurity.com Team
The urllib library in Python ships support for a second, not well known URL scheme for accessing local files ("local_file://"). This scheme can be used to circumvent protections that try to block local file access . Package : python3.4 Version : 3.4.2-1+deb8u5 CVE ID : CVE-2019-9948 The urllib library in Python ships support for a second, not well known URL scheme for accessing local files ("local_file://"). This scheme can be used to circumvent protections that try to block local file access and only block the well-known "file://" schema. This update addresses the vulnerability by disallowing the "local_file://" URL scheme. This update also fixes another regresssion introduced in the update issued as DLA-1835-1 that broke installation of libpython3.4-testsuite. For Debian 8 "Jessie", this problem has been fixed in version 3.4.2-1+deb8u5. We recommend that you upgrade your python3.4 packages. For the detailed security status of python3.4 please refer to its security tracker page at: Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - -- Jonas Meurer . Critical update for Debian 8 to fix urllib local file access issue in Python 3.4, affecting security.. Debian Security, Python Update, Urllib Access, Local File Scheme. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.