External-Mirrors/awx
2
0
Fork 0
mirror of https://github.com/ansible/awx.git synced 2026-03-01 00:38:45 -03:30
Code Issues Packages Projects Releases Wiki Activity

Fix CVE-2023-43665 (#14561)

Browse Source
This commit is contained in:
Hao Liu
2023-10-12 14:00:32 -04:00
committed by GitHub
parent 56878b4910
commit e9bd99c1ff
3 changed files with 2 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
requirements/README.md
View File

@@ -49,19 +49,6 @@ Make sure to delete the old tarball if it is an upgrade.
Anything pinned in `*.in` files involves additional manual work in Anything pinned in `*.in` files involves additional manual work in
order to upgrade. Some information related to that work is outlined here. order to upgrade. Some information related to that work is outlined here.
### Django
For any upgrade of Django, it must be confirmed that
we don't regress on FIPS support before merging.
See internal integration test knowledge base article `how_to_test_FIPS`
for instructions.
If operating in a FIPS environment, `hashlib.md5()` will raise a `ValueError`,
but will support the `usedforsecurity` keyword on RHEL and Centos systems.
This used to be a problem with `names_digest` function in Django, but
was fixed upstream in Django 4.1.
### django-split-settings ### django-split-settings
When we attemed to upgrade past 1.0.0 the build process in GitHub failed on the docker build step with the following error: When we attemed to upgrade past 1.0.0 the build process in GitHub failed on the docker build step with the following error:

2
requirements/requirements.in
View File

@@ -12,7 +12,7 @@ cryptography>=41.0.2 # CVE-2023-38325
Cython<3 # Since the bump to PyYAML 5.4.1 this is now a mandatory dep Cython<3 # Since the bump to PyYAML 5.4.1 this is now a mandatory dep
daphne daphne
distro distro
django==4.2.5 # see UPGRADE BLOCKERs, CVE-2023-41164 django==4.2.6 # CVE-2023-43665
django-auth-ldap django-auth-ldap
django-cors-headers django-cors-headers
django-crum django-crum

2
requirements/requirements.txt
View File

@@ -101,7 +101,7 @@ deprecated==1.2.13
# via jwcrypto # via jwcrypto
distro==1.8.0 distro==1.8.0
# via -r /awx_devel/requirements/requirements.in # via -r /awx_devel/requirements/requirements.in
django==4.2.5 django==4.2.6
# via # via
# -r /awx_devel/requirements/requirements.in # -r /awx_devel/requirements/requirements.in
# channels # channels