Bug#1145999: bookworm-pu: package django-allauth/65.0.2-1+deb13u1

Pierre-Elliott Bécue <[email protected]>
Newsgroups gmane.linux.debian.devel.release
Message-ID <178793573185.1831529.12401879401738448146.reportbug__37866.2360644498$1787936491$gmane$org@metal.pimeys.fr>
Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:django-allauth
User: [email protected]
Usertags: pu

Hello,

[ Reason ]
django-allauth has seen three CVEs reported, of which two I was able to
find in the version released in stable.

I cherry-picked the commits from upstream and built a new version

[ Impact ]
These CVEs are not major, if you believe these changes should not hit
stable it is fine with me.

[ Tests ]
Build and autopkgtest tests do cover the changed code

[ Risks ]
Changes are rather trivial.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
  * d/p/0004: fix(saml): prevent open redirect with IdP initiated SSO
    (Closes: CVE-2026-27982, #1130044)

    This change merely verifies that an url complies with the checks
    done with is_safe_url, as defined in the DefaultAdapter in
    allauth/account/adapter.py
  * d/p/0005: fix(socialaccount): use ``sub`` in Okta/NetIQ
    (Closes: CVE-2025-65431; #1123085)

    This change moves from a mutable field to a non-mutable one
    for the identifier used for the third party account in NetIQ and
    Okta, which means that as soon as the user would change their
    preferred_username, it would induce the creation of another account
    upon relogin.
django-allauth.debdiff (text/plain, 6.1 KB)
diff -Nru django-allauth-65.0.2/debian/changelog django-allauth-65.0.2/debian/changelog
--- django-allauth-65.0.2/debian/changelog	2024-10-20 15:36:10.000000000 +0200
+++ django-allauth-65.0.2/debian/changelog	2026-08-28 18:17:15.000000000 +0200
@@ -1,3 +1,14 @@
+django-allauth (65.0.2-1+deb13u1) trixie; urgency=medium
+
+  * d/p/0004: fix(saml): prevent open redirect with IdP initiated SSO
+    (Closes: CVE-2026-27982, #1130044)
+  * d/p/0005: fix(socialaccount): use ``sub`` in Okta/NetIQ
+    (Closes: CVE-2025-65431; #1123085)
+  * Note: the code vulnerable to CVE-2025-65430 does not seem to exist in
+    65.0.2 and therefore no patch is provided
+
+ -- Pierre-Elliott Bécue <[email protected]>  Fri, 28 Aug 2026 18:17:15 +0200
+
 django-allauth (65.0.2-1) unstable; urgency=medium
 
   * New upstream release 65.0.2
diff -Nru django-allauth-65.0.2/debian/patches/0003-Fix-testing-settings-relying-on-MFA_PASSKEY_SIGNUP_E.patch django-allauth-65.0.2/debian/patches/0003-Fix-testing-settings-relying-on-MFA_PASSKEY_SIGNUP_E.patch
--- django-allauth-65.0.2/debian/patches/0003-Fix-testing-settings-relying-on-MFA_PASSKEY_SIGNUP_E.patch	2024-10-20 15:36:10.000000000 +0200
+++ django-allauth-65.0.2/debian/patches/0003-Fix-testing-settings-relying-on-MFA_PASSKEY_SIGNUP_E.patch	2026-08-28 18:15:30.000000000 +0200
@@ -1,8 +1,8 @@
 From: =?utf-8?q?Pierre-Elliott_B=C3=A9cue?= <[email protected]>
 Date: Sun, 20 Oct 2024 14:53:59 +0200
 Subject: Fix testing settings relying on MFA_PASSKEY_SIGNUP_ENABLED
-Forwarded: https://codeberg.org/allauth/django-allauth/pulls/4150
 
+Forwarded: https://codeberg.org/allauth/django-allauth/pulls/4150
 ---
  allauth/mfa/checks.py               | 2 +-
  tests/headless_only/settings.py     | 3 +++
diff -Nru django-allauth-65.0.2/debian/patches/0004-fix-saml-prevent-open-redirect-with-IdP-initiated-SS.patch django-allauth-65.0.2/debian/patches/0004-fix-saml-prevent-open-redirect-with-IdP-initiated-SS.patch
--- django-allauth-65.0.2/debian/patches/0004-fix-saml-prevent-open-redirect-with-IdP-initiated-SS.patch	1970-01-01 01:00:00.000000000 +0100
+++ django-allauth-65.0.2/debian/patches/0004-fix-saml-prevent-open-redirect-with-IdP-initiated-SS.patch	2026-08-28 18:15:30.000000000 +0200
@@ -0,0 +1,30 @@
+From: Raymond Penners <[email protected]>
+Date: Sat, 7 Feb 2026 23:27:26 +0100
+Subject: fix(saml): prevent open redirect with IdP initiated SSO
+
+---
+ allauth/socialaccount/providers/saml/utils.py | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/allauth/socialaccount/providers/saml/utils.py b/allauth/socialaccount/providers/saml/utils.py
+index c8a3d16..dc49b67 100644
+--- a/allauth/socialaccount/providers/saml/utils.py
++++ b/allauth/socialaccount/providers/saml/utils.py
+@@ -10,6 +10,7 @@ from onelogin.saml2.auth import OneLogin_Saml2_Auth
+ from onelogin.saml2.constants import OneLogin_Saml2_Constants
+ from onelogin.saml2.idp_metadata_parser import OneLogin_Saml2_IdPMetadataParser
+ 
++from allauth.account.adapter import get_adapter as get_account_adapter
+ from allauth.socialaccount.adapter import get_adapter
+ from allauth.socialaccount.models import SocialApp
+ from allauth.socialaccount.providers.saml.provider import SAMLProvider
+@@ -164,7 +165,8 @@ def decode_relay_state(relay_state):
+     if relay_state:
+         parts = urlparse(relay_state)
+         if parts.scheme or parts.netloc or (parts.path and parts.path.startswith("/")):
+-            next_url = relay_state
++            if get_account_adapter().is_safe_url(relay_state):
++                next_url = relay_state
+     return next_url
+ 
+ 
diff -Nru django-allauth-65.0.2/debian/patches/0005-fix-socialaccount-use-sub-in-Okta-NetIQ.patch django-allauth-65.0.2/debian/patches/0005-fix-socialaccount-use-sub-in-Okta-NetIQ.patch
--- django-allauth-65.0.2/debian/patches/0005-fix-socialaccount-use-sub-in-Okta-NetIQ.patch	1970-01-01 01:00:00.000000000 +0100
+++ django-allauth-65.0.2/debian/patches/0005-fix-socialaccount-use-sub-in-Okta-NetIQ.patch	2026-08-28 18:15:30.000000000 +0200
@@ -0,0 +1,37 @@
+From: Raymond Penners <[email protected]>
+Date: Wed, 29 Oct 2025 22:07:53 +0100
+Subject: fix(socialaccount): use ``sub`` in Okta/NetIQ
+
+---
+ allauth/socialaccount/providers/netiq/provider.py | 3 ++-
+ allauth/socialaccount/providers/okta/provider.py  | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/allauth/socialaccount/providers/netiq/provider.py b/allauth/socialaccount/providers/netiq/provider.py
+index f85fa15..c4fa064 100644
+--- a/allauth/socialaccount/providers/netiq/provider.py
++++ b/allauth/socialaccount/providers/netiq/provider.py
+@@ -17,7 +17,8 @@ class NetIQProvider(OAuth2Provider):
+         return ["openid", "profile", "email"]
+ 
+     def extract_uid(self, data):
+-        return str(data["preferred_username"])
++        uid_field = self.app.settings.get("uid_field", "sub")
++        return str(data[uid_field])
+ 
+     def extract_extra_data(self, data):
+         return data
+diff --git a/allauth/socialaccount/providers/okta/provider.py b/allauth/socialaccount/providers/okta/provider.py
+index bdb00ec..0b6ab5e 100644
+--- a/allauth/socialaccount/providers/okta/provider.py
++++ b/allauth/socialaccount/providers/okta/provider.py
+@@ -18,7 +18,8 @@ class OktaProvider(OAuth2Provider):
+         return ["openid", "profile", "email", "offline_access"]
+ 
+     def extract_uid(self, data):
+-        return str(data["preferred_username"])
++        uid_field = self.app.settings.get("uid_field", "sub")
++        return str(data[uid_field])
+ 
+     def extract_extra_data(self, data):
+         return data
diff -Nru django-allauth-65.0.2/debian/patches/series django-allauth-65.0.2/debian/patches/series
--- django-allauth-65.0.2/debian/patches/series	2024-10-20 15:36:10.000000000 +0200
+++ django-allauth-65.0.2/debian/patches/series	2026-08-28 18:15:30.000000000 +0200
@@ -1,3 +1,5 @@
 0001-Remove-all-privacy-breack-links-from-documentation.patch
 0002-Fixes-wrongly-encoded-characters-in-some-.po-files.patch
 0003-Fix-testing-settings-relying-on-MFA_PASSKEY_SIGNUP_E.patch
+0004-fix-saml-prevent-open-redirect-with-IdP-initiated-SS.patch
+0005-fix-socialaccount-use-sub-in-Okta-NetIQ.patch
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.