Processed: bookworm-pu: package djoser/2.1.0-1

[Debian Bug Tracking System]

affects -1 + src:djoser

Bug #1096201 [release.debian.org] bookworm-pu: package djoser/2.1.0-1
Added indication that 1096201 affects src:djoser

[Debian Bug Tracking System]

tag -1 confirmed

Bug #1096201 [release.debian.org] bookworm-pu: package djoser/2.1.0-1
Added tag(s) confirmed.

[Jonathan Wiltshire]

Control: tag -1 confirmed

Please go ahead. Note that oldstable no longer has mainline support, so
you'll be working through the LTS team and not SRMs for that.

Thanks,

[Andreas Henriksson]

Hello,

Post by Jonathan Wiltshire
Control: tag -1 confirmed
Please go ahead. Note that oldstable no longer has mainline support, so
you'll be working through the LTS team and not SRMs for that.

I've uploaded to bookworm, but did not yet get an acknowledgement.
I assume it will need manual processing before that happens, right?

I might have made a mistake though. I still had -security uploads in
mind and the saying from it that first upload to security queue needs
to be a full source upload, so I built with -sa (include full orig
source) when doing my upload, which might be wrong for targeting
"bookworm" or will that be ok? Do you need to reject my upload and I'll
upload again without full source included?

(I'll handle LTS upload later. Just feels like I want stable fixed
before oldstable, for things to happen in "the right order".)

Regards,
Andreas Henriksson

[Jonathan Wiltshire]

package release.debian.org
tags 1096201 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==============

Package: djoser
Version: 2.1.0-1+deb12u1

Explanation: fix authentication bypass [CVE-2024-21543]

[Cyril Brulebois]

Hi,

[ Impact ]
djoser has a very low popcon, so impact should thus be low.
[ Tests ]
not covered by testsuite.
[ Risks ]
The patch cherry-picked from upstream is a revert to a previous state of
the code (before introducing the breakage which wasn't know to have
security implications).
The risks should thus be very low, since it's not "new" code.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
(except debian/gbp.conf branch name, which I think is changelog
clutter)
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
(via a new upstream release)
[ Changes ]
Revert validation code to previous working code with proper
auth validation.

I was curious to see apt install a new package and I had a quick look.
While debian/control received no modifications, the binary package is
getting new dependencies compared to the version in bookworm:

Before:

Depends: python3-django, python3-djangorestframework (>= 3), python3-asgiref, python3-coreapi, python3-social-django, python3:any

After:

Depends: python3-django, python3-djangorestframework (>= 3), python3-asgiref, python3-coreapi, python3-djangorestframework-simplejwt, python3-importlib-metadata | python3 (>> 3.8), python3-social-django, python3:any

For reference, debian/control has:

Depends:
python3-django,
python3-djangorestframework (>= 3),
${misc:Depends},
${python3:Depends},

and the extra dependencies flow through ${python3:Depends}:

python3:Depends=python3-asgiref, python3-coreapi, python3-djangorestframework-simplejwt, python3-importlib-metadata | python3 (>> 3.8), python3-social-django, python3:any


I thought that's curious enough to leave a note here, just in case
someone else wonders whether that's known and/or expected.


Cheers,