python-django 2:2.0.2-1 source package in Debian

Changelog

python-django (2:2.0.2-1) experimental; urgency=medium

  * New upstream security release:
    - CVE-2018-6188: A regression in Django 1.11.8 made
      django.contrib.auth.forms.AuthenticationForm run its
      confirm_login_allowed() method even if an incorrect password is entered.
      This can leak information about a user, depending on what messages
      confirm_login_allowed() raises. If confirm_login_allowed() isn't
      overridden, an attacker enter an arbitrary username and see if that user
      has been set to is_active=False. If confirm_login_allowed() is
      overridden, more sensitive details could be leaked.
  * Use HTTPS Format: URI in debian/copyright.

 -- Chris Lamb <email address hidden>  Thu, 01 Feb 2018 17:57:13 +0000