opensuse-su-2019:0244-1
Vulnerability from csaf_opensuse
Published
2019-02-25 17:32
Modified
2019-02-25 17:32
Summary
Security update for python-Jinja2
Notes
Title of the patch
Security update for python-Jinja2
Description of the patch
This update for python-Jinja2 fixes the following issues:
- Update to 2.8
- Added `target` parameter to urlize function.
- Added support for `followsymlinks` to the file system loader.
- The truncate filter now counts the length.
- Added equalto filter that helps with select filters.
- Changed cache keys to use absolute file names if available
instead of load names.
- Fixed loop length calculation for some iterators.
- Changed how Jinja2 enforces strings to be native strings in
Python 2 to work when people break their default encoding.
- Added :func:`make_logging_undefined` which returns an undefined
object that logs failures into a logger.
- If unmarshalling of cached data fails the template will be
reloaded now.
- Implemented a block ``set`` tag.
- Default cache size was incrased to 400 from a low 50.
- Fixed ``is number`` test to accept long integers in all Python versions.
- Changed ``is number`` to accept Decimal as a number.
- Added a check for default arguments followed by non-default arguments. This
change makes ``{% macro m(x, y=1, z) %}...{% endmacro %}`` a syntax error. The
previous behavior for this code was broken anyway (resulting in the default
value being applied to `y`).
- Add ability to use custom subclasses of ``jinja2.compiler.CodeGenerator`` and
``jinja2.runtime.Context`` by adding two new attributes to the environment
(`code_generator_class` and `context_class`) (pull request ``#404``).
- added support for context/environment/evalctx decorator functions on
the finalize callback of the environment.
- escape query strings for urlencode properly. Previously slashes were not
escaped in that place.
- Add 'base' parameter to 'int' filter.
- Tests are removed from the package (not distributed in the tar.gz)
- Use %python_version over %py_ver: better portability to RHEL
- run testsuite during build
- adjust dependency to use up to date package name for python-MarkupSafe
- Update to 2.7.3 (boo#858239, CVE-2014-0012)
- Security issue: Corrected the security fix for the cache folder.
This fix was provided by RedHat.
- fix package build (file selection missing)
- avoid rebuildcycle with vim
- update to 2.7.2:
- Prefix loader was not forwarding the locals properly to
inner loaders. This is now fixed.
- Security issue: Changed the default folder for the filesystem cache to be
user specific and read and write protected on UNIX systems. See `Debian bug
734747`_ for more information.
- Require python-setuptools instead of distribute (upstreams merged)
- Avoid 'Recommends:' on old rpm distros
- update to 2.7.1:
- Fixed a bug with ``call_filter`` not working properly on environment
and context filters.
- Fixed lack of Python 3 support for bytecode caches.
- Reverted support for defining blocks in included templates as this
broke existing templates for users.
- Fixed some warnings with hashing of undefineds and nodes if Python
is run with warnings for Python 3.
- Added support for properly hashing undefined objects.
- Fixed a bug with the title filter not working on already uppercase
strings.
- update to 2.7:
- Choice and prefix loaders now dispatch source and template lookup
separately in order to work in combination with module loaders as
advertised.
- Fixed filesizeformat.
- Added a non-silent option for babel extraction.
- Added `urlencode` filter that automatically quotes values for
URL safe usage with utf-8 as only supported encoding. If applications
want to change this encoding they can override the filter.
- Added `keep-trailing-newline` configuration to environments and
templates to optionally preserve the final trailing newline.
- Accessing `last` on the loop context no longer causes the iterator
to be consumed into a list.
- Python requirement changed: 2.6, 2.7 or >= 3.3 are required now,
supported by same source code, using the 'six' compatibility library.
- Allow `contextfunction` and other decorators to be applied to `__call__`.
- Added support for changing from newline to different signs in the `wordwrap`
filter.
- Added support for ignoring memcache errors silently.
- Added support for keeping the trailing newline in templates.
- Added finer grained support for stripping whitespace on the left side
of blocks.
- Added `map`, `select`, `reject`, `selectattr` and `rejectattr`
filters.
- Added support for `loop.depth` to figure out how deep inside a recursive
loop the code is.
- Disabled py_compile for pypy and python 3.
- Fix building python 3 package on openSUSE 11.4 x86_64
- Add 2to3 buildrequires to allow for proper conversion of python 3
version
- Add python 3 package
- Simplify vim plugin packaging
- Add suggests for vim and emacs in their respective
packages
- Removed test for obsolete openSUSE version
- Simplified macro usage
- Split of 'vim' and 'emacs' sub-packages that contain syntax highlighting
support for both editors
- Set license to BSD-3-Clause (SPDX style)
- Require python-distribute instead of python-setuptools
- Update to version 2.6:
* internal attributes now raise an internal attribute error now instead
of returning an undefined. This fixes problems when passing undefined
objects to Python semantics expecting APIs.
* traceback support now works properly for PyPy. (Tested with 1.4)
* implemented operator intercepting for sandboxed environments. This
allows application developers to disable builtin operators for better
security. (For instance limit the mathematical operators to actual
integers instead of longs)
* groupby filter now supports dotted notation for grouping by attributes
of attributes.
* scoped blocks not properly treat toplevel assignments and imports.
Previously an import suddenly 'disappeared' in a scoped block.
* automatically detect newer Python interpreter versions before loading code
from bytecode caches to prevent segfaults on invalid opcodes. The segfault
in earlier Jinja2 versions here was not a Jinja2 bug but a limitation in
the underlying Python interpreter. If you notice Jinja2 segfaulting in
earlier versions after an upgrade of the Python interpreter you don't have
to upgrade, it's enough to flush the bytecode cache. This just no longer
makes this necessary, Jinja2 will automatically detect these cases now.
* the sum filter can now sum up values by attribute. This is a backwards
incompatible change. The argument to the filter previously was the
optional starting index which defaultes to zero. This now became the
second argument to the function because it's rarely used.
* like sum, sort now also makes it possible to order items by attribute.
* like sum and sort, join now also is able to join attributes of objects
as string.
* the internal eval context now has a reference to the environment.
* added a mapping test to see if an object is a dict or an object with
a similar interface.
- Renamed to python-Jinja2
- Fix wrong EOL encodings
- Do not require python-setuptools, buildrequires is sufficient
- Removed authors from description
- Changed license to BSD3c
- rpmlint issues cleanup
* fdupes, tar.bz2 tarball, ...
- package docs again (lost with last revision)
- re-generated spec file with py2pack
* now builds for Fedora and Mandriva
- Update to 2.2.1;
- Fixed changes file name.
- initial package (2.1.1)
Patchnames
openSUSE-2019-244
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-Jinja2",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-Jinja2 fixes the following issues:\n\n- Update to 2.8\n - Added `target` parameter to urlize function.\n - Added support for `followsymlinks` to the file system loader.\n - The truncate filter now counts the length.\n - Added equalto filter that helps with select filters.\n - Changed cache keys to use absolute file names if available\n instead of load names.\n - Fixed loop length calculation for some iterators.\n - Changed how Jinja2 enforces strings to be native strings in\n Python 2 to work when people break their default encoding.\n - Added :func:`make_logging_undefined` which returns an undefined\n object that logs failures into a logger.\n - If unmarshalling of cached data fails the template will be\n reloaded now.\n - Implemented a block ``set`` tag.\n - Default cache size was incrased to 400 from a low 50.\n - Fixed ``is number`` test to accept long integers in all Python versions.\n - Changed ``is number`` to accept Decimal as a number.\n - Added a check for default arguments followed by non-default arguments. This\n change makes ``{% macro m(x, y=1, z) %}...{% endmacro %}`` a syntax error. The\n previous behavior for this code was broken anyway (resulting in the default\n value being applied to `y`).\n - Add ability to use custom subclasses of ``jinja2.compiler.CodeGenerator`` and\n ``jinja2.runtime.Context`` by adding two new attributes to the environment\n (`code_generator_class` and `context_class`) (pull request ``#404``).\n - added support for context/environment/evalctx decorator functions on\n the finalize callback of the environment.\n - escape query strings for urlencode properly. Previously slashes were not\n escaped in that place.\n - Add \u0027base\u0027 parameter to \u0027int\u0027 filter.\n- Tests are removed from the package (not distributed in the tar.gz)\n\n- Use %python_version over %py_ver: better portability to RHEL\n\n- run testsuite during build\n\n- adjust dependency to use up to date package name for python-MarkupSafe\n\n- Update to 2.7.3 (boo#858239, CVE-2014-0012)\n - Security issue: Corrected the security fix for the cache folder. \n This fix was provided by RedHat.\n\n- fix package build (file selection missing)\n\n- avoid rebuildcycle with vim \n\n- update to 2.7.2:\n - Prefix loader was not forwarding the locals properly to\n inner loaders. This is now fixed.\n - Security issue: Changed the default folder for the filesystem cache to be\n user specific and read and write protected on UNIX systems. See `Debian bug\n 734747`_ for more information.\n\n- Require python-setuptools instead of distribute (upstreams merged)\n\n- Avoid \u0027Recommends:\u0027 on old rpm distros\n\n- update to 2.7.1:\n - Fixed a bug with ``call_filter`` not working properly on environment\n and context filters.\n - Fixed lack of Python 3 support for bytecode caches.\n - Reverted support for defining blocks in included templates as this\n broke existing templates for users.\n - Fixed some warnings with hashing of undefineds and nodes if Python\n is run with warnings for Python 3.\n - Added support for properly hashing undefined objects.\n - Fixed a bug with the title filter not working on already uppercase\n strings.\n\n- update to 2.7:\n - Choice and prefix loaders now dispatch source and template lookup\n separately in order to work in combination with module loaders as\n advertised.\n - Fixed filesizeformat.\n - Added a non-silent option for babel extraction.\n - Added `urlencode` filter that automatically quotes values for\n URL safe usage with utf-8 as only supported encoding. If applications\n want to change this encoding they can override the filter.\n - Added `keep-trailing-newline` configuration to environments and\n templates to optionally preserve the final trailing newline.\n - Accessing `last` on the loop context no longer causes the iterator\n to be consumed into a list.\n - Python requirement changed: 2.6, 2.7 or \u003e= 3.3 are required now,\n supported by same source code, using the \u0027six\u0027 compatibility library.\n - Allow `contextfunction` and other decorators to be applied to `__call__`.\n - Added support for changing from newline to different signs in the `wordwrap`\n filter.\n - Added support for ignoring memcache errors silently.\n - Added support for keeping the trailing newline in templates.\n - Added finer grained support for stripping whitespace on the left side\n of blocks.\n - Added `map`, `select`, `reject`, `selectattr` and `rejectattr`\n filters.\n - Added support for `loop.depth` to figure out how deep inside a recursive\n loop the code is.\n - Disabled py_compile for pypy and python 3.\n\n- Fix building python 3 package on openSUSE 11.4 x86_64\n\n- Add 2to3 buildrequires to allow for proper conversion of python 3\n version\n\n- Add python 3 package\n- Simplify vim plugin packaging\n- Add suggests for vim and emacs in their respective \n packages\n- Removed test for obsolete openSUSE version\n\n- Simplified macro usage\n\n- Split of \u0027vim\u0027 and \u0027emacs\u0027 sub-packages that contain syntax highlighting\n support for both editors\n\n- Set license to BSD-3-Clause (SPDX style)\n- Require python-distribute instead of python-setuptools\n\n- Update to version 2.6:\n * internal attributes now raise an internal attribute error now instead\n of returning an undefined. This fixes problems when passing undefined\n objects to Python semantics expecting APIs.\n * traceback support now works properly for PyPy. (Tested with 1.4)\n * implemented operator intercepting for sandboxed environments. This\n allows application developers to disable builtin operators for better\n security. (For instance limit the mathematical operators to actual\n integers instead of longs)\n * groupby filter now supports dotted notation for grouping by attributes\n of attributes.\n * scoped blocks not properly treat toplevel assignments and imports.\n Previously an import suddenly \u0027disappeared\u0027 in a scoped block.\n * automatically detect newer Python interpreter versions before loading code\n from bytecode caches to prevent segfaults on invalid opcodes. The segfault\n in earlier Jinja2 versions here was not a Jinja2 bug but a limitation in\n the underlying Python interpreter. If you notice Jinja2 segfaulting in\n earlier versions after an upgrade of the Python interpreter you don\u0027t have\n to upgrade, it\u0027s enough to flush the bytecode cache. This just no longer\n makes this necessary, Jinja2 will automatically detect these cases now.\n * the sum filter can now sum up values by attribute. This is a backwards\n incompatible change. The argument to the filter previously was the\n optional starting index which defaultes to zero. This now became the\n second argument to the function because it\u0027s rarely used.\n * like sum, sort now also makes it possible to order items by attribute.\n * like sum and sort, join now also is able to join attributes of objects\n as string.\n * the internal eval context now has a reference to the environment.\n * added a mapping test to see if an object is a dict or an object with\n a similar interface.\n\n- Renamed to python-Jinja2\n- Fix wrong EOL encodings\n\n- Do not require python-setuptools, buildrequires is sufficient\n- Removed authors from description\n- Changed license to BSD3c\n\n- rpmlint issues cleanup\n * fdupes, tar.bz2 tarball, ...\n- package docs again (lost with last revision)\n\n- re-generated spec file with py2pack\n * now builds for Fedora and Mandriva\n\n- Update to 2.2.1;\n- Fixed changes file name.\n\n- initial package (2.1.1)",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2019-244",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_0244-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2019:0244-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J6U2NCERMUWAZTZY5VD4C4YB2XD5EDKW/#J6U2NCERMUWAZTZY5VD4C4YB2XD5EDKW"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2019:0244-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J6U2NCERMUWAZTZY5VD4C4YB2XD5EDKW/#J6U2NCERMUWAZTZY5VD4C4YB2XD5EDKW"
},
{
"category": "self",
"summary": "SUSE Bug 858239",
"url": "https://bugzilla.suse.com/858239"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0012 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0012/"
}
],
"title": "Security update for python-Jinja2",
"tracking": {
"current_release_date": "2019-02-25T17:32:38Z",
"generator": {
"date": "2019-02-25T17:32:38Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2019:0244-1",
"initial_release_date": "2019-02-25T17:32:38Z",
"revision_history": [
{
"date": "2019-02-25T17:32:38Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-Jinja2-2.8-2.1.noarch",
"product": {
"name": "python-Jinja2-2.8-2.1.noarch",
"product_id": "python-Jinja2-2.8-2.1.noarch"
}
},
{
"category": "product_version",
"name": "python-Jinja2-emacs-2.8-2.1.noarch",
"product": {
"name": "python-Jinja2-emacs-2.8-2.1.noarch",
"product_id": "python-Jinja2-emacs-2.8-2.1.noarch"
}
},
{
"category": "product_version",
"name": "python-Jinja2-vim-2.8-2.1.noarch",
"product": {
"name": "python-Jinja2-vim-2.8-2.1.noarch",
"product_id": "python-Jinja2-vim-2.8-2.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 12",
"product": {
"name": "SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:12"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-Jinja2-2.8-2.1.noarch as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:python-Jinja2-2.8-2.1.noarch"
},
"product_reference": "python-Jinja2-2.8-2.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-Jinja2-emacs-2.8-2.1.noarch as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:python-Jinja2-emacs-2.8-2.1.noarch"
},
"product_reference": "python-Jinja2-emacs-2.8-2.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-Jinja2-vim-2.8-2.1.noarch as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:python-Jinja2-vim-2.8-2.1.noarch"
},
"product_reference": "python-Jinja2-vim-2.8-2.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-0012",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0012"
}
],
"notes": [
{
"category": "general",
"text": "FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user\u0027s uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:python-Jinja2-2.8-2.1.noarch",
"SUSE Package Hub 12:python-Jinja2-emacs-2.8-2.1.noarch",
"SUSE Package Hub 12:python-Jinja2-vim-2.8-2.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0012",
"url": "https://www.suse.com/security/cve/CVE-2014-0012"
},
{
"category": "external",
"summary": "SUSE Bug 858239 for CVE-2014-0012",
"url": "https://bugzilla.suse.com/858239"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:python-Jinja2-2.8-2.1.noarch",
"SUSE Package Hub 12:python-Jinja2-emacs-2.8-2.1.noarch",
"SUSE Package Hub 12:python-Jinja2-vim-2.8-2.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-02-25T17:32:38Z",
"details": "moderate"
}
],
"title": "CVE-2014-0012"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…