[SECURITY] Fedora 20 Update: python-djblets-0.7.21-1.fc20

[updates at fedoraproject.org]

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2013-18840
2013-10-11 16:26:15
--------------------------------------------------------------------------------

Name        : python-djblets
Product     : Fedora 20
Version     : 0.7.21
Release     : 1.fc20
URL         : http://www.review-board.org
Summary     : A collection of useful classes and functions for Django
Description :
A collection of useful classes and functions for Django

--------------------------------------------------------------------------------
Update Information:

Review Board 1.6.19 and 1.7.15 fix a few issues in the API where users could access certain data they should not have been able to access, if using the Local Sites feature, invite-only groups, or private repositories. It also fixes cases with invite-only groups where the group name and list of private review requests would show up on some pages (though the review requests themselves were not accessible).

These issues do not affect most of the installations out there, but we strongly recommend upgrading anyway. There are no known cases of anyone exploiting these bugs, and in fact we discovered these internally while building new tools to test for security vulnerabilities in our codebase.

There are also some other bug fixes, and important changes needed for extensions that provide their own REST APIs.
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1016596 - CVE-2013-4410 ReviewBoard: access-control problems with REST API
        https://bugzilla.redhat.com/show_bug.cgi?id=1016596
  [ 2 ] Bug #1016599 - CVE-2013-4411 ReviewBoard: URL processing allows unauthorized users to view review lists
        https://bugzilla.redhat.com/show_bug.cgi?id=1016599
  [ 3 ] Bug #1016601 - CVE-2013-4409 python-djblets: unsanitized eval() vulnerability
        https://bugzilla.redhat.com/show_bug.cgi?id=1016601
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update python-djblets' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------