URL describes a vulnerability in 1.2.3, and 1.1.3 (but probably also applies to 1.1.2). Also AFAIK 1.0.* is not longer supported upstream, so should probably be dropped from portage.
Thanks for the report. From $URL: Today the Django team is issuing multiple releases -- Django 1.2.4, Django 1.1.3 and Django 1.3 beta 1 -- to remedy two security issues reported to us. All users of affected versions of Django are urged to upgrade immediately. Looks like dev-python/django-1.2.4 is already in the tree thanks to arfrever. So... Arches, please test and mark stable: =dev-python/django-1.2.4 Target keywords : "amd64 x86"
dev-python/django-1.2.4 contains a known regression, which was reported in #django-dev after I have added dev-python/django-1.2.4 to the tree.
(In reply to comment #2) > dev-python/django-1.2.4 contains a known regression, which was reported in > #django-dev after I have added dev-python/django-1.2.4 to the tree. > Ok, thanks. I guess we'll wait for another release.
(In reply to comment #2) > dev-python/django-1.2.4 contains a known regression, which was reported in > #django-dev after I have added dev-python/django-1.2.4 to the tree. > You should mark that bug as a blocker to this one.
CVE Assignment via: http://www.openwall.com/lists/oss-security/2011/01/03/5 > > I), Information leakage in Django administrative interface Use CVE-2010-4534 > > II), Denial-of-service attack in password-reset mechanism Use CVE-2010-4535
(In reply to comment #2) The regression has been fixed in dev-python/django-1.2.4-r1.
Stabilize dev-python/django-1.2.4-r1.
amd64 ok
amd64 done. Thanks Agostino
x86 stable, last one so update the whiteboard
GLSA vote: NO
python: Please remove any leftover vulnerable ebuilds.
(In reply to comment #12) > python: Please remove any leftover vulnerable ebuilds. > This has been done; thanks, Arfrever. GLSA Vote: No too. Closing NOGLSA.
