j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-11 04:36:48 +00:00
Code Issues Projects Releases Wiki Activity

fix(install): openSUSE installs get python-ldap and pyasn1 without known flaws

Browse source 
The installer's venv sees the system site packages, and pip keeps a
system package that meets a requirement. On openSUSE Leap 15.6 the LDAP
login thus ran on the distro's python-ldap 3.4.4 (CVE-2025-61911, a
filter-escaping bypass, and CVE-2025-61912) and pyasn1 0.5.0
(CVE-2026-30922 and others), which django-auth-ldap loads through
ldap.controls. python-ldap>=3.4.5 and pyasn1>=0.6.4 make pip install
fixed copies in the venv. python-ldap builds there, so openldap2-devel
joins the openSUSE package lists (installer, manual and development
setup) and the update steps. Checked in a fresh Leap 15.6 container
with the installer's package list: 3.4.8 and 0.6.4 from the venv,
ldap.controls imports.
This commit is contained in:
catborise 2026-10-11 22:21:49 +03:00
parent d706d58de4
commit 3be3b4b2cc
3 changed files with 7 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

3
conf/requirements.txt
View file

@ -4,6 +4,9 @@ django-bootstrap-icons==0.9.0
django-otp==1.7.4
django-qr-code==4.2.0
django-auth-ldap==5.3.0
# the installer's venv can otherwise keep older distro copies (openSUSE 15.6)
python-ldap>=3.4.5
pyasn1>=0.6.4
django-axes==8.3.1
djangorestframework==3.18.3
drf-nested-routers==0.95.3