686153 - Upgrade Django to 1.3.1

Status: VERIFIED FIXED

(support.mozilla.org :: General, defect, P1)

Description

[James Socol [:jsocol, :james]]

There is a security release of Django, version 1.3.1, and we should upgrade immediately. We do not believe we are vulnerable to any of the vectors patched here, so this is not worth an emergency release, but better safe than sorry.

We want rev cbe855040fd55e7d2a2ea365742ea2b3f53d2829

Comment 1

[Erik Rose [:erik][:erikrose]]

Merged.

master: http://github.com/jsocol/kitsune/commit/d87cfaecf363d1c8ec482a9a4297cf498d58a985
next: http://github.com/jsocol/kitsune/commit/b3e988b2a239fff2d092f99933d1a34eebe4d97d

Comment 2

[James Socol [:jsocol, :james]]

Thanks, Erik!

Comment 3

[James Socol [:jsocol, :james]]

Marking [qa-] because I continue to believe we were safe from these specific attack vectors* so I don't believe there's any behavior change that can be manually verified. As our test suites pass with this change, I'm content to trust normal general regression testing and other automation. This was a relatively small change in Django.

https://www.djangoproject.com/weblog/2011/sep/09/security-releases-issued/

* It's _possible_ that we're vulnerable to the session tampering vector, but the original report doesn't mention anything about using the write-through cache-DB session backend, which is what we use.

Comment 4

[Rebecca Billings [:rbillings]]

Automation ran successfully, marking closed as [qa-]

Comment 5

[Will Kahn-Greene [:willkg] ET needinfo? me]

These bugs are all resolved, so I'm removing the security flag from them.