Hi,

The attached diff updates py-django to 1.1.1 which was released
yesterday.  This security release is to correct a recently discovered
vulnerability which is described below.  I've tested on i386 and it
seems to be working ok.

Vulnerability description from
http://www.djangoproject.com/weblog/2009/oct/09/security/
Django's forms library included field types which perform
regular-expression-based validation of email addresses and URLs.
Certain addresses/URLs could trigger a pathological performance case
in this regular expression, resulting in the server process/thread
becoming unresponsive, and consuming excessive CPU over an extended
period of time. If deliberately triggered, this could result in an
effective denial-of-service attack.

Any additional testing/feedback is greatly appreciated.

Thanks,
Ryan

Attachment: pyDjango111.diff
Description: Binary data

Reply via email to