CVE-2019-8341

An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing

An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing

This update for python-Jinja2 to version 2.10.1 fixes the following issues:

Security issues fixed:

• CVE-2019-8341: Fixed a command injection in from_string() (bsc#1125815).
• CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format (bsc#1132323).

This update was imported from the SUSE:SLE-15:Update update project.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Track already fixed issues.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for python-Jinja2 to version 2.10.1 fixes the following issues:

Security issues fixed:

• CVE-2019-8341: Fixed a command injection in from_string() (bsc#1125815).
• CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format (bsc#1132323).

This update for python-Jinja2 fixes the following issues:

Security issues fixed:

• CVE-2016-10745: Fixed a sandbox escape caused by an information disclosure via str.format (bsc#1132174).
• CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format (bsc#1132323).
• CVE-2019-8341: Fixed command injection in function from_string (bsc#1125815).

This update for python-Jinja2 fixes the following issues:

• CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format (bsc#1132323).
• CVE-2019-8341: Fixed a command injection in function from_string (bsc#1125815).

This update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark fixes the following issues:

Security changes included on this update:

grafana:

• CVE-2020-24303: Fixed an XXS with series overides. (bsc#1178243)

influxdb:

• CVE-2019-20933: Fixed an authentication bypass. (bsc#1178988)

python-Jinja2:

• CVE-2019-10906,CVE-2019-8341,CVE-2016-10745: 'SandboxedEnvironment' securely handles 'str.format_map' in order to prevent code execution through untrusted format strings. (bsc#1132323, bsc#1125815, bsc#1132174)

python-pysaml2:

• CVE-2020-5390: Fixed an issue where there was no check that the signature in a SAML document is enveloped. (bsc#1160851)

python-urllib3:

• CVE-2020-26137: Fixed a CRLF injection via HTTP request method. (bsc#1177120)

Non-security changes included in this update:

Changes in ardana-cassandra:

• Update to version 9.0+git.1600802664.7e480a2:
  • Remove freezer related backup/restore code (SOC-7751)

Changes in ardana-mq:

• Update to version 9.0+git.1605174486.a78ddce:
  • Re-enable mirroring of fanout and reply queues (bsc#1177611)

Changes in ardana-osconfig:

• Update to version 9.0+git.1601621747.a87e5a0:
  • HOS8 check needs to be a shell rather than command (SOC-11184)

Changes in ardana-tempest:

• Update to version 9.0+git.1603378983.fc0bca9:

  • Enable VPNaaS testing (SOC-8764)

• Update to version 9.0+git.1599855218.875b2f3:

  • unblacklist some revert tests (SOC-9178)

Changes in crowbar-core:

• Update to version 6.0+git.1606314264.bf9ada813:

  • ntp: Do not use rate-limiting (bsc#1179161)

• Update to version 6.0+git.1600414599.150832ca2:

  • Ignore CVE-2020-15169 (SOC-11391)

Changes in crowbar-openstack:

• Update to version 6.0+git.1604573541.bb18c172d:

  • rabbitmq: Fix crm running check (SOC-11240)

• Update to version 6.0+git.1604491402.b4dbba849:

  • Remove aspiers from CODEOWNERS
  • Remove cmurphy from CODEOWNERS

Changes in grafana:

• Fix bsc#1178243 CVE-2020-24303 by adding 25401-Fix-XSS-vulnerability-with-series-overrides.patch

Changes in influxdb:

• Add CVE-2019-20933.patch (bsc#1178988, CVE-2019-20933) to fix authentication bypass
• Declare license files correctly

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev20:

  • PowerMax Driver - Legacy volumes fail to live migrate

• Update to version cinder-13.0.10.dev19:

  • RBD: Cleanup temporary file during exception

• Update to version cinder-13.0.10.dev17:

  • Remove experimental job legacy-tempest-dsvm-zeromq-multibackend

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev20:

  • PowerMax Driver - Legacy volumes fail to live migrate

• Update to version cinder-13.0.10.dev19:

  • RBD: Cleanup temporary file during exception

• Update to version cinder-13.0.10.dev17:

  • Remove experimental job legacy-tempest-dsvm-zeromq-multibackend

Changes in openstack-heat:

• Update to version openstack-heat-11.0.4.dev4:

  • Check external resources after creation

• Update to version openstack-heat-11.0.4.dev2:

  • Don't store signal_url for ec2 signaling of deployments
  • Allow scale-down of ASG as part of update 11.0.3

Changes in openstack-heat:

• Update to version openstack-heat-11.0.4.dev4:

  • Check external resources after creation

• Update to version openstack-heat-11.0.4.dev2:

  • Don't store signal_url for ec2 signaling of deployments
  • Allow scale-down of ASG as part of update 11.0.3

Changes in openstack-heat-gbp:

• Update to version group-based-policy-automation-12.0.1.dev2:

  • Add support for victoria

• Update to version group-based-policy-automation-12.0.1.dev1: *…