CVE-2017-12794

Advisory

Tendenci 11.0.4 updates its requirements.txt to require django >=1.11.16 because there are vulnerabilities in Django 1.11.x before 1.11.15.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

* Default no-reply address for newsletter sender
* Changed PYBB_DEFAULT_TIME_ZONE to match with the default TIME_ZONE setting
* Fixed get_url_patterns for addons
* Fixed an error in recurring payments for authnet
* Fixed some issues in projects
* Applied urlencode filter for tags
* Fixed some issues in global search
* Updated requirements.txt to require django >=1.11.16 because there are vulnerabilities in Django 1.11.x before 1.11.15
* Other fixes

Resources

• https://pypi.org/project/tendenci
• https://pyup.io/changelogs/tendenci/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12794