Wed Apr 20 12:28:57 2022 UTC ()
py-django2: updated to 2.2.28

Django 2.2.28 fixes two security issues with severity ���high��� in 2.2.27.

CVE-2022-28346: Potential SQL injection in QuerySet.annotate(), aggregate(), and extra()

QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods.

CVE-2022-28347: Potential SQL injection via QuerySet.explain(**options) on PostgreSQL

QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument.


(adam)
diff -r1.42 -r1.43 pkgsrc/www/py-django2/Makefile
diff -r1.39 -r1.40 pkgsrc/www/py-django2/distinfo
cvs diff -r1.42 -r1.43 pkgsrc/www/py-django2/Attic/Makefile (expand / switch to unified diff)

--- pkgsrc/www/py-django2/Attic/Makefile 2022/02/02 10:17:19 1.42
+++ pkgsrc/www/py-django2/Attic/Makefile 2022/04/20 12:28:57 1.43
@@ -1,16 +1,16 @@ @@ -1,16 +1,16 @@
1# $NetBSD: Makefile,v 1.42 2022/02/02 10:17:19 adam Exp $ 1# $NetBSD: Makefile,v 1.43 2022/04/20 12:28:57 adam Exp $
2 2
3DISTNAME= Django-2.2.27 3DISTNAME= Django-2.2.28
4PKGNAME= ${PYPKGPREFIX}-${DISTNAME:tl} 4PKGNAME= ${PYPKGPREFIX}-${DISTNAME:tl}
5CATEGORIES= www python 5CATEGORIES= www python
6MASTER_SITES= https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/ 6MASTER_SITES= https://www.djangoproject.com/m/releases/${PKGVERSION_NOREV:R}/
7MASTER_SITES+= ${MASTER_SITE_PYPI:=D/Django/} 7MASTER_SITES+= ${MASTER_SITE_PYPI:=D/Django/}
8 8
9MAINTAINER= joerg@NetBSD.org 9MAINTAINER= joerg@NetBSD.org
10HOMEPAGE= https://www.djangoproject.com/ 10HOMEPAGE= https://www.djangoproject.com/
11COMMENT= Django, a high-level Python Web framework 11COMMENT= Django, a high-level Python Web framework
12LICENSE= modified-bsd 12LICENSE= modified-bsd
13 13
14DEPENDS+= ${PYPKGPREFIX}-pytz-[0-9]*:../../time/py-pytz 14DEPENDS+= ${PYPKGPREFIX}-pytz-[0-9]*:../../time/py-pytz
15 15
16USE_LANGUAGES= # none 16USE_LANGUAGES= # none
cvs diff -r1.39 -r1.40 pkgsrc/www/py-django2/Attic/distinfo (expand / switch to unified diff)

--- pkgsrc/www/py-django2/Attic/distinfo 2022/02/02 10:17:19 1.39
+++ pkgsrc/www/py-django2/Attic/distinfo 2022/04/20 12:28:57 1.40
@@ -1,5 +1,5 @@ @@ -1,5 +1,5 @@
1$NetBSD: distinfo,v 1.39 2022/02/02 10:17:19 adam Exp $ 1$NetBSD: distinfo,v 1.40 2022/04/20 12:28:57 adam Exp $
2 2
3BLAKE2s (Django-2.2.27.tar.gz) = 6acf7763f3a10c05d2aef04d1342c9da238e1a63fe3829e3694946f5bbe53a0f 3BLAKE2s (Django-2.2.28.tar.gz) = 5ea76cca148513c4af6a38d1ed05bff2674dac53492a8b85b10c4be79709c4d7
4SHA512 (Django-2.2.27.tar.gz) = 0db670651a820b49d855e38a336c0c6990ce4701bb686c5e8a292ccb03342e995c61c2c628b1d625d2715404e969fc31c256e5bf0fd6c1ff714d1c1c1ee30bff 4SHA512 (Django-2.2.28.tar.gz) = 228aec6ee8619ff3d0397ff867bd59352900fb95557bd02cfea594b3bc3f813b5bcd13f488b451b0ee79a4d52deab19c5e97aa40f1075ba06db72542d119228e
5Size (Django-2.2.27.tar.gz) = 9185716 bytes 5Size (Django-2.2.28.tar.gz) = 9187543 bytes