catborise 3be3b4b2cc fix(install): openSUSE installs get python-ldap and pyasn1 without known flaws ... The installer's venv sees the system site packages, and pip keeps a system package that meets a requirement. On openSUSE Leap 15.6 the LDAP login thus ran on the distro's python-ldap 3.4.4 (CVE-2025-61911, a filter-escaping bypass, and CVE-2025-61912) and pyasn1 0.5.0 (CVE-2026-30922 and others), which django-auth-ldap loads through ldap.controls. python-ldap>=3.4.5 and pyasn1>=0.6.4 make pip install fixed copies in the venv. python-ldap builds there, so openldap2-devel joins the openSUSE package lists (installer, manual and development setup) and the update steps. Checked in a fresh Leap 15.6 container with the installer's package list: 3.4.8 and 0.6.4 from the venv, ldap.controls imports.		2026-10-11 22:45:52 +03:00
..
daemon	fix(gstfsd): a key added to an SELinux guest gets the guest's labels	2026-10-08 16:19:24 +03:00
nginx	fix(static): collectstatic writes to staticfiles/, and its output is no longer committed	2026-10-07 16:31:56 +03:00
runit	fix(docker): the database, secret key and settings are private to the app user in the container	2026-10-07 18:48:28 +03:00
supervisor	conf(gstfsd): show how to allow a remote bind in supervisor and systemd	2026-10-02 23:10:04 +03:00
systemd	conf(gstfsd): show how to allow a remote bind in supervisor and systemd	2026-10-02 23:10:04 +03:00
install-lib.sh	fix(settings): ALLOWED_HOSTS lists the server's names instead of accepting any host	2026-10-07 16:31:51 +03:00
requirements.txt	fix(install): openSUSE installs get python-ldap and pyasn1 without known flaws	2026-10-11 22:45:52 +03:00
test-vm.xml	test(instances): isolate the live libvirt suite on shared hosts	2026-10-04 01:08:11 +03:00
test_install_lib.sh	fix(settings): ALLOWED_HOSTS lists the server's names instead of accepting any host	2026-10-07 16:31:51 +03:00