Hi Moritz,
> > This also affects stable from my reading of the code. Shall I
> > prepare an upload to stretch-security?
[..]
> Please do.
debdiff attached, awaiting t...@security.debian.org ACK to upload.
Best wishes,
--
,''`.
: :' : Chris Lamb
`. `'` la...@debian.org / chris-lamb.co.uk
`-
diff --git a/debian/changelog b/debian/changelog
index b1c56f7c5..d6472a04e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+python-django (1:1.10.7-2+deb9u4) stretch-security; urgency=high
+
+ * CVE-2019-3498: Fix a content spoofing vulnerability in the default
+ 404 page. (Closes: #918230)
+
+ -- Chris Lamb <la...@debian.org> Sat, 05 Jan 2019 21:36:27 +0100
+
python-django (1:1.10.7-2+deb9u3) stretch; urgency=medium
* Default to supporting Spatialite >= 4.2. (Closes: #910240)
diff --git a/debian/patches/0017-CVE-2019-3498.patch
b/debian/patches/0017-CVE-2019-3498.patch
new file mode 100644
index 000000000..ea647e964
--- /dev/null
+++ b/debian/patches/0017-CVE-2019-3498.patch
@@ -0,0 +1,401 @@
+From: Tom Hacohen <t...@users.noreply.github.com>
+Date: Fri, 4 Jan 2019 02:21:55 +0000
+Subject: Fixed #30070,
+ CVE-2019-3498 -- Fixed content spoofing possiblity in the default 404 page.
+
+Co-Authored-By: Tim Graham <timogra...@gmail.com>
+Backport of 1ecc0a395be721e987e8e9fdfadde952b6dee1c7 from master.
+---
+ ...0006-Default-to-supporting-Spatialite-4.2.patch | 4 +--
+ debian/patches/0013-CVE-2018-7536.patch | 6 ++--
+ debian/patches/0015-CVE-2018-14574.patch | 2 +-
+ .../patches/02_disable-sources-in-sphinxdoc.diff | 5 ++--
+ .../06_use_debian_geoip_database_as_default.diff | 3 +-
+ debian/patches/fix-migration-fake-initial-1.patch | 20 ++++++++++----
+ debian/patches/fix-migration-fake-initial-2.patch | 32 ++++++++++++++++------
+ .../fix-test-middleware-classes-headers.patch | 7 ++---
+ debian/patches/series | 1 +
+ django/views/defaults.py | 8 ++++--
+ tests/handlers/tests.py | 12 +++++---
+ 11 files changed, 65 insertions(+), 35 deletions(-)
+
+diff --git a/debian/patches/0006-Default-to-supporting-Spatialite-4.2.patch
b/debian/patches/0006-Default-to-supporting-Spatialite-4.2.patch
+index 6c92929..41e6f79 100644
+--- a/debian/patches/0006-Default-to-supporting-Spatialite-4.2.patch
++++ b/debian/patches/0006-Default-to-supporting-Spatialite-4.2.patch
+@@ -14,10 +14,10 @@ See, for example:
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+ diff --git a/django/contrib/gis/db/backends/spatialite/base.py
b/django/contrib/gis/db/backends/spatialite/base.py
+-index 1f03868..6d0d631 100644
++index 44514a8..a26270b 100644
+ --- a/django/contrib/gis/db/backends/spatialite/base.py
+ +++ b/django/contrib/gis/db/backends/spatialite/base.py
+-@@ -35,7 +35,7 @@ class DatabaseWrapper(SQLiteDatabaseWrapper):
++@@ -30,7 +30,7 @@ class DatabaseWrapper(SQLiteDatabaseWrapper):
+ # cannot be found by `ctypes.util.find_library`), then it may be set
+ # manually in the settings via the `SPATIALITE_LIBRARY_PATH` setting.
+ self.spatialite_lib = getattr(settings, 'SPATIALITE_LIBRARY_PATH',
+diff --git a/debian/patches/0013-CVE-2018-7536.patch
b/debian/patches/0013-CVE-2018-7536.patch
+index 5b1be8f..e54ae4f 100644
+--- a/debian/patches/0013-CVE-2018-7536.patch
++++ b/debian/patches/0013-CVE-2018-7536.patch
+@@ -5,8 +5,8 @@ Subject: Fix CVE-2018-7536 -- DOS in urlize
+ This is a security fix.
+ ---
+ django/utils/html.py | 33 +++++++++++++++++++++------------
+- tests/utils_tests/test_html.py | 9 +++++++++
+- 2 files changed, 30 insertions(+), 12 deletions(-)
++ tests/utils_tests/test_html.py | 8 ++++++++
++ 2 files changed, 29 insertions(+), 12 deletions(-)
+
+ diff --git a/django/utils/html.py b/django/utils/html.py
+ index a5cb56e..5a9f735 100644
+@@ -81,7 +81,7 @@ index a5cb56e..5a9f735 100644
+ try:
+ domain = domain.encode('idna').decode('ascii')
+ diff --git a/tests/utils_tests/test_html.py b/tests/utils_tests/test_html.py
+-index 20de851..9f76d48 100644
++index 20de851..8b683c1 100644
+ --- a/tests/utils_tests/test_html.py
+ +++ b/tests/utils_tests/test_html.py
+ @@ -231,3 +231,11 @@ class TestUtilsHtml(SimpleTestCase):
+diff --git a/debian/patches/0015-CVE-2018-14574.patch
b/debian/patches/0015-CVE-2018-14574.patch
+index c8bf439..2996c0a 100644
+--- a/debian/patches/0015-CVE-2018-14574.patch
++++ b/debian/patches/0015-CVE-2018-14574.patch
+@@ -27,7 +27,7 @@ Backported by Chris Lamb <la...@debian.org> from:
+ 6 files changed, 49 insertions(+), 4 deletions(-)
+
+ diff --git a/django/middleware/common.py b/django/middleware/common.py
+-index 4cec6f0..4ac5e01 100644
++index 4cec6f0..ca35bd4 100644
+ --- a/django/middleware/common.py
+ +++ b/django/middleware/common.py
+ @@ -9,6 +9,7 @@ from django.urls import is_valid_path
+diff --git a/debian/patches/02_disable-sources-in-sphinxdoc.diff
b/debian/patches/02_disable-sources-in-sphinxdoc.diff
+index bcb214f..f2619d4 100644
+--- a/debian/patches/02_disable-sources-in-sphinxdoc.diff
++++ b/debian/patches/02_disable-sources-in-sphinxdoc.diff
+@@ -1,5 +1,4 @@
+-From fbe85f8899cacc79be7864d853e80899288d3e4c Mon Sep 17 00:00:00 2001
+-From: =?UTF-8?q?Rapha=C3=ABl=20Hertzog?= <hert...@debian.org>
++From: =?utf-8?q?Rapha=C3=ABl_Hertzog?= <hert...@debian.org>
+ Date: Sun, 11 Oct 2015 11:43:19 +1100
+ Subject: Disable creation of _sources directory by Sphinx
+
+@@ -16,7 +15,7 @@ Patch-Name: 02_disable-sources-in-sphinxdoc.diff
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+ diff --git a/docs/conf.py b/docs/conf.py
+-index 5f57ce57e..5b1fab2fd 100644
++index 5f57ce5..5b1fab2 100644
+ --- a/docs/conf.py
+ +++ b/docs/conf.py
+ @@ -212,7 +212,10 @@ html_additional_pages = {}
+diff --git a/debian/patches/06_use_debian_geoip_database_as_default.diff
b/debian/patches/06_use_debian_geoip_database_as_default.diff
+index 16faff7..ac82e69 100644
+--- a/debian/patches/06_use_debian_geoip_database_as_default.diff
++++ b/debian/patches/06_use_debian_geoip_database_as_default.diff
+@@ -1,4 +1,3 @@
+-From 0e464e28dd41c3a8d8fc0f3317650ec4e029b8c5 Mon Sep 17 00:00:00 2001
+ From: Tapio Rantala <tapio.rant...@iki.fi>
+ Date: Sun, 11 Oct 2015 11:43:20 +1100
+ Subject: Use Debian GeoIP database path as default
+@@ -16,7 +15,7 @@ Patch-Name: 06_use_debian_geoip_database_as_default.diff
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+ diff --git a/django/contrib/gis/geoip/base.py
b/django/contrib/gis/geoip/base.py
+-index d40ae7e9a..1e33033b8 100644
++index d40ae7e..1e33033 100644
+ --- a/django/contrib/gis/geoip/base.py
+ +++ b/django/contrib/gis/geoip/base.py
+ @@ -68,7 +68,8 @@ class GeoIP(object):
+diff --git a/debian/patches/fix-migration-fake-initial-1.patch
b/debian/patches/fix-migration-fake-initial-1.patch
+index 63513b8..915562d 100644
+--- a/debian/patches/fix-migration-fake-initial-1.patch
++++ b/debian/patches/fix-migration-fake-initial-1.patch
+@@ -1,9 +1,13 @@
+-From c6d66195d7f816aeb47a77570bdd3836a99d4183 Mon Sep 17 00:00:00 2001
+-From: =?UTF-8?q?Rapha=C3=ABl=20Hertzog?= <hert...@debian.org>
++From: =?utf-8?q?Rapha=C3=ABl_Hertzog?= <hert...@debian.org>
+ Date: Mon, 29 May 2017 15:44:39 +0200
+ Subject: [PATCH 1/2] Move detect_soft_applied() from
+ django.db.migrations.executor to .loader
+ MIME-Version: 1.0
++Content-Type: text/plain; charset="utf-8"
++Content-Transfer-Encoding: 8bit
++
++From c6d66195d7f816aeb47a77570bdd3836a99d4183 Mon Sep 17 00:00:00 2001
++MIME-Version: 1.0
+ Content-Type: text/plain; charset=UTF-8
+ Content-Transfer-Encoding: 8bit
+
+@@ -17,11 +21,13 @@ Signed-off-by: Raphaël Hertzog <hert...@debian.org>
+ Bug: https://code.djangoproject.com/ticket/28250
+ Bug-Debian: https://bugs.debian.org/863267
+ ---
+- django/db/migrations/executor.py | 83
+--------------------------------------
+- django/db/migrations/loader.py | 81 ++++++++++++++++++++++++++++++++++++++
++ django/db/migrations/executor.py | 83 +------------------------------------
++ django/db/migrations/loader.py | 86
+++++++++++++++++++++++++++++++++++++--
+ tests/migrations/test_executor.py | 12 +++---
+- 3 files changed, 88 insertions(+), 88 deletions(-)
++ 3 files changed, 90 insertions(+), 91 deletions(-)
+
++diff --git a/django/db/migrations/executor.py
b/django/db/migrations/executor.py
++index 1a0b6f6..2ac787b 100644
+ --- a/django/db/migrations/executor.py
+ +++ b/django/db/migrations/executor.py
+ @@ -1,8 +1,5 @@
+@@ -124,6 +130,8 @@ Bug-Debian: https://bugs.debian.org/863267
+ - # If we get this far and we found at least one CreateModel or
AddField migration,
+ - # the migration is considered implicitly applied.
+ - return (found_create_model_migration or found_add_field_migration),
after_state
++diff --git a/django/db/migrations/loader.py b/django/db/migrations/loader.py
++index 3a34e6d..4904343 100644
+ --- a/django/db/migrations/loader.py
+ +++ b/django/db/migrations/loader.py
+ @@ -4,8 +4,9 @@ import os
+@@ -238,6 +246,8 @@ Bug-Debian: https://bugs.debian.org/863267
+ + # If we get this far and we found at least one CreateModel or
AddField migration,
+ + # the migration is considered implicitly applied.
+ + return (found_create_model_migration or found_add_field_migration),
after_state
++diff --git a/tests/migrations/test_executor.py
b/tests/migrations/test_executor.py
++index 847b11c..d0f5228 100644
+ --- a/tests/migrations/test_executor.py
+ +++ b/tests/migrations/test_executor.py
+ @@ -326,7 +326,7 @@ class ExecutorTests(MigrationTestBase):
+diff --git a/debian/patches/fix-migration-fake-initial-2.patch
b/debian/patches/fix-migration-fake-initial-2.patch
+index bb29c2f..286d211 100644
+--- a/debian/patches/fix-migration-fake-initial-2.patch
++++ b/debian/patches/fix-migration-fake-initial-2.patch
+@@ -1,9 +1,13 @@
+-From e4ed4431d5730e4a8efc3d76d79ee5c16b5a2340 Mon Sep 17 00:00:00 2001
+ From: Marten Kenbeek <marten.k...@gmail.com>
+ Date: Wed, 31 May 2017 13:35:43 +0200
+ Subject: [PATCH] Fixed #25850 -- Ignored soft applied migrations in
+ consistency check.
+ MIME-Version: 1.0
++Content-Type: text/plain; charset="utf-8"
++Content-Transfer-Encoding: 8bit
++
++From e4ed4431d5730e4a8efc3d76d79ee5c16b5a2340 Mon Sep 17 00:00:00 2001
++MIME-Version: 1.0
+ Content-Type: text/plain; charset=UTF-8
+ Content-Transfer-Encoding: 8bit
+
+@@ -25,9 +29,11 @@ Bug-Debian: https://bugs.debian.org/863267
+ django/db/migrations/executor.py | 7 ++-
+ django/db/migrations/loader.py | 28 +++++++---
+ tests/migrations/test_executor.py | 63
+++++++++++++++++++++--
+- tests/migrations/test_loader.py | 27 ++++++++++
+- 6 files changed, 114 insertions(+), 15 deletions(-)
++ tests/migrations/test_loader.py | 27 +++++++++-
++ 6 files changed, 113 insertions(+), 16 deletions(-)
+
++diff --git a/django/core/management/commands/makemigrations.py
b/django/core/management/commands/makemigrations.py
++index 486c897..ec7d057 100644
+ --- a/django/core/management/commands/makemigrations.py
+ +++ b/django/core/management/commands/makemigrations.py
+ @@ -106,7 +106,7 @@ class Command(BaseCommand):
+@@ -39,6 +45,8 @@ Bug-Debian: https://bugs.debian.org/863267
+
+ # Before anything else, see if there's conflicting apps and drop out
+ # hard if there are any and they don't want to merge
++diff --git a/django/core/management/commands/migrate.py
b/django/core/management/commands/migrate.py
++index 6846b33..784a70b 100644
+ --- a/django/core/management/commands/migrate.py
+ +++ b/django/core/management/commands/migrate.py
+ @@ -83,7 +83,7 @@ class Command(BaseCommand):
+@@ -50,6 +58,8 @@ Bug-Debian: https://bugs.debian.org/863267
+
+ # Before anything else, see if there's conflicting apps and drop out
+ # hard if there are any
++diff --git a/django/db/migrations/executor.py
b/django/db/migrations/executor.py
++index 2ac787b..f8d46cf 100644
+ --- a/django/db/migrations/executor.py
+ +++ b/django/db/migrations/executor.py
+ @@ -76,6 +76,11 @@ class MigrationExecutor(object):
+@@ -73,6 +83,8 @@ Bug-Debian: https://bugs.debian.org/863267
+ if applied:
+ fake = True
+ if not fake:
++diff --git a/django/db/migrations/loader.py b/django/db/migrations/loader.py
++index 4904343..95b2c3d 100644
+ --- a/django/db/migrations/loader.py
+ +++ b/django/db/migrations/loader.py
+ @@ -268,13 +268,14 @@ class MigrationLoader(object):
+@@ -152,6 +164,8 @@ Bug-Debian: https://bugs.debian.org/863267
+ ]
+ if field.column not in column_names:
+ return False, project_state
++diff --git a/tests/migrations/test_executor.py
b/tests/migrations/test_executor.py
++index d0f5228..8c26198 100644
+ --- a/tests/migrations/test_executor.py
+ +++ b/tests/migrations/test_executor.py
+ @@ -297,6 +297,59 @@ class ExecutorTests(MigrationTestBase):
+@@ -253,9 +267,11 @@ Bug-Debian: https://bugs.debian.org/863267
+
+ # Cleanup by removing the remaining tables.
+ with connection.schema_editor() as editor:
++diff --git a/tests/migrations/test_loader.py b/tests/migrations/test_loader.py
++index c269837..df12b37 100644
+ --- a/tests/migrations/test_loader.py
+ +++ b/tests/migrations/test_loader.py
+-@@ -8,7 +8,7 @@ from django.db.migrations.exceptions imp
++@@ -8,7 +8,7 @@ from django.db.migrations.exceptions import (
+ )
+ from django.db.migrations.loader import MigrationLoader
+ from django.db.migrations.recorder import MigrationRecorder
+@@ -264,10 +280,11 @@ Bug-Debian: https://bugs.debian.org/863267
+ from django.utils import six
+
+
+-@@ -402,6 +402,31 @@ class LoaderTests(TestCase):
++@@ -401,6 +401,31 @@ class LoaderTests(TestCase):
++ recorder.record_applied('migrations', '0003_third')
+ loader.check_consistent_history(connection)
+
+- @override_settings(MIGRATION_MODULES={
+++ @override_settings(MIGRATION_MODULES={
+ + "migrations": "migrations.test_migrations_first",
+ + "migrations2": "migrations2.test_migrations_2_first",
+ + })
+@@ -292,7 +309,6 @@ Bug-Debian: https://bugs.debian.org/863267
+ + with self.assertRaisesMessage(InconsistentMigrationHistory, msg):
+ + loader.check_consistent_history(connection, fake_initial=True)
+ +
+-+ @override_settings(MIGRATION_MODULES={
++ @override_settings(MIGRATION_MODULES={
+ "app1": "migrations.test_migrations_squashed_ref_squashed.app1",
+ "app2": "migrations.test_migrations_squashed_ref_squashed.app2",
+- })
+diff --git a/debian/patches/fix-test-middleware-classes-headers.patch
b/debian/patches/fix-test-middleware-classes-headers.patch
+index 3d7e0a3..4b2e75f 100644
+--- a/debian/patches/fix-test-middleware-classes-headers.patch
++++ b/debian/patches/fix-test-middleware-classes-headers.patch
+@@ -1,4 +1,3 @@
+-From fa63fc91ccc08b20ed4ca45e73f7aad2b38d9171 Mon Sep 17 00:00:00 2001
+ From: Chris Lamb <ch...@chris-lamb.co.uk>
+ Date: Wed, 31 May 2017 15:25:09 +0100
+ Subject: [PATCH] [1.11.x] Fixed #26755 -- Fixed
+@@ -13,7 +12,7 @@ Bug-Debian: https://bugs.debian.org/816435
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+ diff --git a/tests/project_template/test_settings.py
b/tests/project_template/test_settings.py
+-index a0047dd836d..791c42e03ae 100644
++index d153c4d..c24a08e 100644
+ --- a/tests/project_template/test_settings.py
+ +++ b/tests/project_template/test_settings.py
+ @@ -1,11 +1,12 @@
+@@ -30,7 +29,7 @@ index a0047dd836d..791c42e03ae 100644
+
+
+ @unittest.skipIf(
+-@@ -15,16 +16,16 @@
++@@ -15,16 +16,16 @@ from django.utils._os import upath
+ )
+ class TestStartProjectSettings(TestCase):
+ def setUp(self):
+@@ -53,7 +52,7 @@ index a0047dd836d..791c42e03ae 100644
+
+ def test_middleware_headers(self):
+ """
+-@@ -32,7 +33,8 @@ def test_middleware_headers(self):
++@@ -32,7 +33,8 @@ class TestStartProjectSettings(TestCase):
+ change. For example, we never want "Vary: Cookie" to appear in the
list
+ since it prevents the caching of responses.
+ """
+diff --git a/debian/patches/series b/debian/patches/series
+index 6ccbb74..f588a67 100644
+--- a/debian/patches/series
++++ b/debian/patches/series
+@@ -8,3 +8,4 @@ fix-test-middleware-classes-headers.patch
+ 0015-CVE-2018-14574.patch
+ 0016-CVE-2017-12794.patch
+ 0006-Default-to-supporting-Spatialite-4.2.patch
++0011-Fixed-30070-CVE-2019-3498-Fixed-content-spoofing-pos.patch
+diff --git a/django/views/defaults.py b/django/views/defaults.py
+index 348837e..5ec9ac8 100644
+--- a/django/views/defaults.py
++++ b/django/views/defaults.py
+@@ -2,6 +2,7 @@ from django import http
+ from django.template import Context, Engine, TemplateDoesNotExist, loader
+ from django.utils import six
+ from django.utils.encoding import force_text
++from django.utils.http import urlquote
+ from django.views.decorators.csrf import requires_csrf_token
+
+ ERROR_404_TEMPLATE_NAME = '404.html'
+@@ -21,7 +22,8 @@ def page_not_found(request, exception,
template_name=ERROR_404_TEMPLATE_NAME):
+ Templates: :template:`404.html`
+ Context:
+ request_path
+- The path of the requested URL (e.g., '/app/pages/bad_page/')
++ The path of the requested URL (e.g., '/app/pages/bad_page/'). It's
++ quoted to prevent a content injection attack.
+ exception
+ The message from the exception which triggered the 404 (if one was
+ supplied), or the exception class name
+@@ -37,7 +39,7 @@ def page_not_found(request, exception,
template_name=ERROR_404_TEMPLATE_NAME):
+ if isinstance(message, six.text_type):
+ exception_repr = message
+ context = {
+- 'request_path': request.path,
++ 'request_path': urlquote(request.path),
+ 'exception': exception_repr,
+ }
+ try:
+@@ -50,7 +52,7 @@ def page_not_found(request, exception,
template_name=ERROR_404_TEMPLATE_NAME):
+ raise
+ template = Engine().from_string(
+ '<h1>Not Found</h1>'
+- '<p>The requested URL {{ request_path }} was not found on this
server.</p>')
++ '<p>The requested resource was not found on this server.</p>')
+ body = template.render(Context(context))
+ content_type = 'text/html'
+ return http.HttpResponseNotFound(body, content_type=content_type)
+diff --git a/tests/handlers/tests.py b/tests/handlers/tests.py
+index 9f01cb2..50a3488 100644
+--- a/tests/handlers/tests.py
++++ b/tests/handlers/tests.py
+@@ -2,6 +2,7 @@
+
+ from __future__ import unicode_literals
+
++import sys
+ import unittest
+
+ from django.core.exceptions import ImproperlyConfigured
+@@ -19,6 +20,8 @@ try:
+ except ImportError: # Python < 3.5
+ HTTPStatus = None
+
++PY37 = sys.version_info >= (3, 7, 0)
++
+
+ class HandlerTests(SimpleTestCase):
+
+@@ -180,16 +183,17 @@ class HandlerRequestTests(SimpleTestCase):
+
+ def test_invalid_urls(self):
+ response = self.client.get('~%A9helloworld')
+- self.assertContains(response, '~%A9helloworld', status_code=404)
++ self.assertEqual(response.status_code, 404)
++ self.assertEqual(response.context['request_path'],
'/~%25A9helloworld' if PY37 else '/%7E%25A9helloworld')
+
+ response = self.client.get('d%aao%aaw%aan%aal%aao%aaa%aad%aa/')
+- self.assertContains(response, 'd%AAo%AAw%AAn%AAl%AAo%AAa%AAd%AA',
status_code=404)
++ self.assertEqual(response.context['request_path'],
'/d%25AAo%25AAw%25AAn%25AAl%25AAo%25AAa%25AAd%25AA')
+
+ response = self.client.get('/%E2%99%E2%99%A5/')
+- self.assertContains(response, '%E2%99\u2665', status_code=404)
++ self.assertEqual(response.context['request_path'],
'/%25E2%2599%E2%99%A5/')
+
+ response = self.client.get('/%E2%98%8E%E2%A9%E2%99%A5/')
+- self.assertContains(response, '\u260e%E2%A9\u2665', status_code=404)
++ self.assertEqual(response.context['request_path'],
'/%E2%98%8E%25E2%25A9%E2%99%A5/')
+
+ def test_environ_path_info_type(self):
+ environ = RequestFactory().get('/%E2%A8%87%87%A5%E2%A8%A0').environ
diff --git a/debian/patches/series b/debian/patches/series
index 6ccbb746a..5bda383eb 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,3 +8,4 @@ fix-test-middleware-classes-headers.patch
0015-CVE-2018-14574.patch
0016-CVE-2017-12794.patch
0006-Default-to-supporting-Spatialite-4.2.patch
+0017-CVE-2019-3498.patch
