Debian Patches

Status for python-werkzeug/1.0.1+dfsg1-2+deb11u2

Search:

Patch	Description	Author	Forwarded	Bugs	Origin	Last update
CVE-2024-34069-1.patch	restrict debugger trusted hosts Add a list of `trusted_hosts` to the `DebuggedApplication` middleware. It defaults to only allowing `localhost`, `.localhost` subdomains, and `127.0.0.1`. `run_simple(use_debugger=True)` adds its `hostname` argument to the trusted list as well. The middleware can be used directly to further modify the trusted list in less common development scenarios. The debugger UI uses the full `document.location` instead of only `document.location.pathname`. Either of these fixes on their own mitigates the reported vulnerability. (cherry picked from commit 71b69dfb7df3d912e66bab87fbb1f21f83504967)	David Lord <davidism@gmail.com>	no			2024-05-02
CVE-2024-34069-2.patch	only require trusted host for evalex (cherry picked from commit 890b6b62634fa61224222aee31081c61b054ff01)	David Lord <davidism@gmail.com>	no			2024-05-03
disable-sphinxcontrib-log_cabinet.patch	Disable sphinxcontrib.log_cabinet extension	Ondřej Nový <onovy@debian.org>	no
don-t-strip-leading-when-parsing-cookie.patch	don't strip leading = when parsing cookie	David Lord <davidism@gmail.com>	no	debian	https://github.com/pallets/werkzeug/commit/8c2b4b82d0cade0d37e6a88e2cd2413878e8ebd4	2023-01-31
drop_ubuntu_font.patch	drop_ubuntu_font	SVN-Git Migration <python-modules-team@lists.alioth.debian.org>	no			2015-10-08
limit-the-maximum-number-of-multipart-form-parts.patch	limit the maximum number of multipart form parts Add a limit to the number of multipart form data parts the parser will attempt to parse. If the limit is exceeded, it raises `RequestEntityTooLargeError`. A default of 1000 seems large enough to allow legitimate use cases while preventing the previous unlimited parsing. This differs from similar settings that are unset by default, as I think safe defaults are better practice. The limit can be adjusted per request by changing it on the request object before parsing. For example, it can be set based on what you expect a given endpoint to handle. ```python req.max_form_parts = 20 form = req.form ```	pgjones <philip.graham.jones@googlemail.com>	no	debian	https://github.com/pallets/werkzeug/commit/fe899d0cdf767a7289a8bf746b7f72c2907a1b4b	2023-01-29
pytest-timeout.patch	Don't mark warning as error in pytest during build We don't have python-pytest-timeout (for Python 2) so we need to ignore warning about PytestUnknownMarkWarning.	Ondřej Nový (onovy@debian.org)	no

Showing 1 to 7 of 7 entries

All known versions for source package 'python-werkzeug'

3.1.3-2 (trixie, sid)
2.2.2-3+deb12u1 (bookworm)
2.0.2+dfsg1-3~bpo11+1 (bullseye-backports)
1.0.1+dfsg1-2+deb11u2 (bullseye-security)
1.0.1+dfsg1-2+deb11u1 (bullseye)

Links