From e44a0bfbf7406fb8ee973686cb83e1bb9c10e9c3 Mon Sep 17 00:00:00 2001
From: starlet-dx <15929766099@163.com>
Date: Fri, 12 Jul 2024 15:19:51 +0800
Subject: [PATCH] Update to 4.2.14 for fix
CVE-2024-38875,CVE-2024-39329,CVE-2024-39330 and CVE-2024-39614
(cherry picked from commit 3de1f69ae7f0e5ee077c370770e49a13fe903b43)
---
CVE-2023-41164.patch | 85 ---------
CVE-2023-43665.patch | 167 -----------------
CVE-2023-46695.patch | 61 -------
CVE-2024-24680.patch | 191 --------------------
CVE-2024-27351.patch | 122 -------------
Django-4.2.3.tar.gz => Django-4.2.14.tar.gz | Bin 10419003 -> 10432993 bytes
python-django.spec | 22 +--
7 files changed, 10 insertions(+), 638 deletions(-)
delete mode 100644 CVE-2023-41164.patch
delete mode 100644 CVE-2023-43665.patch
delete mode 100644 CVE-2023-46695.patch
delete mode 100644 CVE-2024-24680.patch
delete mode 100644 CVE-2024-27351.patch
rename Django-4.2.3.tar.gz => Django-4.2.14.tar.gz (57%)
diff --git a/CVE-2023-41164.patch b/CVE-2023-41164.patch
deleted file mode 100644
index f0071a3..0000000
--- a/CVE-2023-41164.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 9c51b4dcfa0cefcb48231f4d71cafa80821f87b9 Mon Sep 17 00:00:00 2001
-From: Mariusz Felisiak Joel is a slug Joel is a slug Joel is a slug
Joel is a…
"), # 10 chars - ] - for value, expected in perf_test_values: - with self.subTest(value=value): -@@ -176,15 +183,25 @@ class TestUtilsText(SimpleTestCase): - truncator = text.Truncator("I <3 python, what about you?
") - self.assertEqual("I <3 python,…
", truncator.words(3, html=True)) - -+ @patch("django.utils.text.Truncator.MAX_LENGTH_HTML", 10_000) -+ def test_truncate_words_html_size_limit(self): -+ max_len = text.Truncator.MAX_LENGTH_HTML -+ bigger_len = text.Truncator.MAX_LENGTH_HTML + 1 -+ valid_html = "Joel is a slug
" # 4 words - perf_test_values = [ -- ("", -- "&" * 50000, -- "_X<<<<<<<<<<<>", -+ ("", None), -+ ("", "", None), -+ (valid_html * bigger_len, valid_html * 12 + "Joel is…
"), # 50 words - ] -- for value in perf_test_values: -+ for value, expected in perf_test_values: - with self.subTest(value=value): - truncator = text.Truncator(value) -- self.assertEqual(value, truncator.words(50, html=True)) -+ self.assertEqual( -+ expected if expected else value, truncator.words(50, html=True) -+ ) - - def test_wrap(self): - digits = "1234 67 9" --- -2.30.0 - diff --git a/CVE-2023-46695.patch b/CVE-2023-46695.patch deleted file mode 100644 index 88d0902..0000000 --- a/CVE-2023-46695.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 048a9ebb6ea468426cb4e57c71572cbbd975517f Mon Sep 17 00:00:00 2001 -From: Mariusz FelisiakI <3 python, what about you?
") - self.assertEqual("I <3 python,…
", truncator.words(3, html=True)) - -+ # Only open brackets. -+ test = "<" * 60_000 -+ truncator = text.Truncator(test) -+ self.assertEqual(truncator.words(1, html=True), test) -+ -+ # Tags with special chars in attrs. -+ truncator = text.Truncator( -+ """Hello, my dear lady!""" -+ ) -+ self.assertEqual( -+ """Hello, my dear…""", -+ truncator.words(3, html=True), -+ ) -+ -+ # Tags with special non-latin chars in attrs. -+ truncator = text.Truncator("""Hello, my dear lady!
""") -+ self.assertEqual( -+ """Hello, my dear…
""", -+ truncator.words(3, html=True), -+ ) -+ -+ # Misplaced brackets. -+ truncator = text.Truncator("hello >< world") -+ self.assertEqual(truncator.words(1, html=True), "hello…") -+ self.assertEqual(truncator.words(2, html=True), "hello >< world") -+ - @patch("django.utils.text.Truncator.MAX_LENGTH_HTML", 10_000) - def test_truncate_words_html_size_limit(self): - max_len = text.Truncator.MAX_LENGTH_HTML --- -2.33.0 - diff --git a/Django-4.2.3.tar.gz b/Django-4.2.14.tar.gz similarity index 57% rename from Django-4.2.3.tar.gz rename to Django-4.2.14.tar.gz index 7ba120fa7e2d45a32d709fa1ef540770aee1afa5..1adca203d4c84ae31f3a0798fc6ab4c1ee276b95 100644 GIT binary patch delta 9783855 zcmV((K;XZ-_WK0kn-+zuRd_
zuSkEacaOT%QttlU$Kg&bZdUEMA|1KZfbBYp(?|rG`i}Vx4|a6>9}*}zP1y6De5(qq
zK3&`f5fU@D4I2hL_R)i8K#wd>b9>!wG#BY%SLCHJ)K{?5wW6YA;Gy+;e7tg;Gibx;
zkwf4`>l-4b$7Io8AbR@$Jo>-7>(vY27+9Hr-N~Tj-Jio$w(=}~{@0oR;r}|}J~-Ao
z;crn1>bL>H#>wshYrP=g^5gab$nWlwe%R}Hxd(K2ypjxTwS8Rcc6U3E^g18Teww6^
z>+kr_djJC3FV^}j&}}KoeXI%x$I+96Ny;$*`ub@;1(%t~z3o?fjdUfv$wZNqP3z&6
z*?&IO3^&~-`zkVAGP@n1&d^A;awb40qLrfZ)r@mh&$Vyfw1(n$tcIz{XxU+r9o?|Y8!Ls
z@{aZ&Zd?Yx?U!fPs|L59^L&&*BuIT5FPU}EQh&5*xJU+`1oWt_CauHmj+=!qyN>jH
zwx~jSp^t2Bs`K=#Z|gw}^{$daWvum%^xwhw=T??q_xV)
vcsJdpu
z(VJ-4SL{I4_;=0;U7>+kr_%2sd5FovZxgJTZyo+pm{a%l7qg0C<0=GMz9xT&-3UD@
z*zCcoN~m7L)#!blHd()Frv5`+yk1lFJvXibdUA>{B@%B`2}yFhFF7$cjly*s9O61)
zkR?99+Kg+#GKgI=Y?_pO>MIFiVA$4F9eqtEOhy;_UTtVQh?6xPx3{$Tnwz#HEj>lw
zSl!M?u40>ZM2A_fM_+FLMqYkGM}5&r&bBjq%9FnY>L$OmozgPK_()WCZJoW5=NbhX
zV%!ugi-Faq5TD3bVCh7aF#nqRY8f@9kYAM5Uz|{qX
L|=HvB2?$%9UD(L-)L^tHM!$aF!xfFKXF)v07H
z7~;M*`mTAYn4R*o|KIMEMCZG-)CAE72MWE5bG#I&r(aF+11weQ@>mMI+c`;irg^ot
zWNmJfskEu8a#6SVw_sIx&EJ40{^E&K%TBPb