[Python-modules-team] Bug#934026: python-django: CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235

[Moritz Muehlenhoff]

On Thu, Aug 08, 2019 at 11:22:37AM +0100, Chris Lamb wrote:
> Moritz Muehlenhoff wrote:
> 
> > > I mention it specifically as I'm not 100% confident this is correct
> > > and Lintian somewhat-correctly complained about a "missing" version
> > > (to wit, 1:1.11.22-1 its technically missing).
> > 
> > Where does Lintian parse the data about existing releases? How does it
> > know that 1:1.11.22-1 is missing?
> 
> debian/changelog. Lintian, as a strict rule, does not query external
> sources.
> 
> (I should probably clarify; missing *sequential* releases.)

Got it. From my PoV Lintian should probably just waive that check
unless the target distro for the upload is "unstable".

Cheers,
        Moritz