CVE-2014-0012

FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.

FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.

This update for python-Jinja2 fixes the following issues:

• Update to 2.8

  • Added target parameter to urlize function.
  • Added support for followsymlinks to the file system loader.
  • The truncate filter now counts the length.
  • Added equalto filter that helps with select filters.
  • Changed cache keys to use absolute file names if available instead of load names.
  • Fixed loop length calculation for some iterators.
  • Changed how Jinja2 enforces strings to be native strings in Python 2 to work when people break their default encoding.
  • Added :func:make_logging_undefined which returns an undefined object that logs failures into a logger.
  • If unmarshalling of cached data fails the template will be reloaded now.
  • Implemented a block set tag.
  • Default cache size was incrased to 400 from a low 50.
  • Fixed is number test to accept long integers in all Python versions.
  • Changed is number to accept Decimal as a number.
  • Added a check for default arguments followed by non-default arguments. This change makes {% macro m(x, y=1, z) %}...{% endmacro %} a syntax error. The previous behavior for this code was broken anyway (resulting in the default value being applied to y).
  • Add ability to use custom subclasses of jinja2.compiler.CodeGenerator and jinja2.runtime.Context by adding two new attributes to the environment (code_generator_class and context_class) (pull request #404).
  • added support for context/environment/evalctx decorator functions on the finalize callback of the environment.
  • escape query strings for urlencode properly. Previously slashes were not escaped in that place.
  • Add 'base' parameter to 'int' filter.

• Tests are removed from the package (not distributed in the tar.gz)

• Use %python_version over %py_ver: better portability to RHEL

• run testsuite during build

• adjust dependency to use up to date package name for python-MarkupSafe

• Update to 2.7.3 (boo#858239, CVE-2014-0012)

  • Security issue: Corrected the security fix for the cache folder.
    This fix was provided by RedHat.

• fix package build (file selection missing)

• avoid rebuildcycle with vim

• update to 2.7.2:

  • Prefix loader was not forwarding the locals properly to inner loaders. This is now fixed.
  • Security issue: Changed the default folder for the filesystem cache to be user specific and read and write protected on UNIX systems. See Debian bug 734747_ for more information.

• Require python-setuptools instead of distribute (upstreams merged)

• Avoid 'Recommends:' on old rpm distros

• update to 2.7.1:

• Fixed a bug with call_filter not working properly on environment and context filters.

• Fixed lack of Python 3 support for bytecode caches.

• Reverted support for defining blocks in included templates as this broke existing templates for users.

• Fixed some warnings with hashing of undefineds and nodes if Python is run with warnings for Python 3.

• Added support for properly hashing undefined objects.

• Fixed a bug with the title filter not working on already uppercase strings.

• update to 2.7:

  • Choice and prefix loaders now dispatch source and template lookup separately in order to work in combination with module loaders as advertised.
  • Fixed filesizeformat.
  • Added a non-silent option for babel extraction.
  • Added urlencode filter that automatically quotes values for URL safe usage with utf-8 as only supported encoding. If applications want to change this encoding they can override the filter.
  • Added keep-trailing-newline configuration to environments and templates to optionally preserve the final trailing newline.
  • Accessing last on the loop context no longer causes the iterator to be consumed into a list.
  • Python requirement changed: 2.6, 2.7 or >= 3.3 are required now, supported by same source code, using the 'six'…

These are all security issues fixed in the python-Jinja2-2.8-1.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-Jinja2-3.0.1-3.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Jinja2-3.1.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Jinja2-3.1.6-2.4 package on the GA media of openSUSE Tumbleweed.

FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Track already fixed issues.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

The python-Jinja2 package was updated to version 2.7.3 to fix a security issues and some build problems.

The following vulnerabilities were fixed:

• Update to 2.7.3 (bnc#858239, CVE-2014-0012)
  • Security issue: Corrected the security fix for the cache folder.
    This fix was provided by RedHat.

The following build issues were fixed:

• run testsuite during build
• adjust dependency to use up to date package name for python-MarkupSafe
• fix package build (file selection missing)

FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.