mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-10 20:26:48 +00:00
3be3b4b2cc
The installer's venv sees the system site packages, and pip keeps a system package that meets a requirement. On openSUSE Leap 15.6 the LDAP login thus ran on the distro's python-ldap 3.4.4 (CVE-2025-61911, a filter-escaping bypass, and CVE-2025-61912) and pyasn1 0.5.0 (CVE-2026-30922 and others), which django-auth-ldap loads through ldap.controls. python-ldap>=3.4.5 and pyasn1>=0.6.4 make pip install fixed copies in the venv. python-ldap builds there, so openldap2-devel joins the openSUSE package lists (installer, manual and development setup) and the update steps. Checked in a fresh Leap 15.6 container with the installer's package list: 3.4.8 and 0.6.4 from the venv, ldap.controls imports.
25 lines
600 B
Text
25 lines
600 B
Text
Django==5.2.18
|
|
django_bootstrap5==26.3
|
|
django-bootstrap-icons==0.9.0
|
|
django-otp==1.7.4
|
|
django-qr-code==4.2.0
|
|
django-auth-ldap==5.3.0
|
|
# the installer's venv can otherwise keep older distro copies (openSUSE 15.6)
|
|
python-ldap>=3.4.5
|
|
pyasn1>=0.6.4
|
|
django-axes==8.3.1
|
|
djangorestframework==3.18.3
|
|
drf-nested-routers==0.95.3
|
|
drf-spectacular[sidecar]==0.30.0
|
|
eventlet==0.41.2
|
|
gunicorn==26.2.0
|
|
libsass==0.23.0
|
|
libvirt-python>=9.0.0
|
|
lxml>=6.1
|
|
paramiko==5.0.0
|
|
psycopg[binary]==3.3.6
|
|
python-engineio==4.14.0
|
|
python-socketio==5.17.0
|
|
websockify==0.13.0
|
|
whitenoise==6.12.0
|
|
crypt-r>=3.13.0; python_version >= "3.13"
|