diff --git a/CVE-2020-28493.patch b/CVE-2020-28493.patch old mode 100755 new mode 100644 diff --git a/CVE-2025-27516.patch b/CVE-2025-27516.patch new file mode 100644 index 0000000000000000000000000000000000000000..464538c739b6ee35694e45c66011d28099a05e27 --- /dev/null +++ b/CVE-2025-27516.patch @@ -0,0 +1,81 @@ +From 286c463968e9f55b4bd7a860161182fe55bc7632 Mon Sep 17 00:00:00 2001 +From: Lumir Balhar +Date: Wed, 26 Mar 2025 22:03:02 +0100 +Subject: [PATCH] CVE-2025-27516 + +--- + Jinja2-2.10.1/jinja2/filters.py | 28 +++++++++++----------------- + Jinja2-2.10.1/tests/test_security.py | 10 ++++++++++ + 2 files changed, 21 insertions(+), 17 deletions(-) + +diff --git a/Jinja2-2.10.1/jinja2/filters.py b/Jinja2-2.10.1/jinja2/filters.py +index 3e33f57..9816094 100644 +--- a/Jinja2-2.10.1/jinja2/filters.py ++++ b/Jinja2-2.10.1/jinja2/filters.py +@@ -13,6 +13,7 @@ import math + import random + import warnings + ++from inspect import getattr_static + from itertools import groupby, chain + from collections import namedtuple + from jinja2.utils import Markup, escape, pformat, urlize, soft_unicode, \ +@@ -931,27 +932,20 @@ def do_reverse(value): + + @environmentfilter + def do_attr(environment, obj, name): +- """Get an attribute of an object. ``foo|attr("bar")`` works like +- ``foo.bar`` just that always an attribute is returned and items are not +- looked up. ++ """Get an attribute of an object. ``foo|attr("bar")`` works like ++ ``foo.bar``, but returns undefined instead of falling back to ``foo["bar"]`` ++ if the attribute doesn't exist. + + See :ref:`Notes on subscriptions ` for more details. + """ + try: +- name = str(name) +- except UnicodeError: +- pass +- else: +- try: +- value = getattr(obj, name) +- except AttributeError: +- pass +- else: +- if environment.sandboxed and not \ +- environment.is_safe_attribute(obj, name, value): +- return environment.unsafe_undefined(obj, name) +- return value +- return environment.undefined(obj=obj, name=name) ++ getattr_static(obj, name) ++ except AttributeError: ++ # This finds dynamic attrs, and we know it's not a descriptor at this point. ++ if not hasattr(obj, name): ++ return environment.undefined(obj=obj, name=name) ++ ++ return environment.getattr(obj, name) + + + @contextfilter +diff --git a/Jinja2-2.10.1/tests/test_security.py b/Jinja2-2.10.1/tests/test_security.py +index 1719644..b2ba1a3 100644 +--- a/Jinja2-2.10.1/tests/test_security.py ++++ b/Jinja2-2.10.1/tests/test_security.py +@@ -223,3 +223,13 @@ class TestStringFormatMap(object): + + with pytest.raises(SecurityError): + t.render() ++ ++ def test_attr_filter(self) -> None: ++ env = SandboxedEnvironment() ++ t = env.from_string( ++ """{{ "{0.__call__.__builtins__[__import__]}" ++ | attr("format")(not_here) }}""" ++ ) ++ ++ with pytest.raises(SecurityError): ++ t.render() +-- +2.49.0 + diff --git a/Jinja2-2.10.1.tar.gz b/Jinja2-2.10.1.tar.gz deleted file mode 100755 index ffd10546db30d3b8594aa231dcfca1b010d95860..0000000000000000000000000000000000000000 Binary files a/Jinja2-2.10.1.tar.gz and /dev/null differ diff --git a/dist b/dist new file mode 100644 index 0000000000000000000000000000000000000000..1fe92cf0fdf9c2625d878a2ace258f64c1e8ca44 --- /dev/null +++ b/dist @@ -0,0 +1 @@ +an8_10 diff --git a/download b/download new file mode 100644 index 0000000000000000000000000000000000000000..479d0d13cfb86a2cc33b5cff3c4e4ab83f2fb4ae --- /dev/null +++ b/download @@ -0,0 +1 @@ +0ae535be40fd215a8114a090c8b68e5a Jinja2-2.10.1.tar.gz diff --git a/python-jinja2.spec b/python-jinja2.spec old mode 100755 new mode 100644 index fc825c0402a643ee3c8ac011d30bf9ca163d73c4..4bd8f38771971ad77557cddd22009f44bf0e2842 --- a/python-jinja2.spec +++ b/python-jinja2.spec @@ -1,4 +1,4 @@ -%define anolis_release .0.4 +%define anolis_release .0.1 %if 0%{?rhel} > 7 # Disable python2 build by default %bcond_with python2 @@ -28,7 +28,7 @@ Name: python-jinja2 Version: 2.10.1 -Release: 3%{anolis_release}%{?dist} +Release: 7%{anolis_release}%{?dist} Summary: General purpose template engine Group: Development/Languages License: BSD @@ -40,6 +40,9 @@ Source0: https://files.pythonhosted.org/packages/source/J/Jinja2/Jinja2-% # Upstream commit: https://github.com/pallets/jinja/pull/1343/commits/ef658dc3b6389b091d608e710a810ce8b87995b3 # Tracking bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1928707 Patch0: CVE-2020-28493.patch + +# Security fix for CVE-2024-22195 +# Resolved upstream: https://github.com/pallets/jinja/commit/7dd3680e6eea0d77fde024763657aa4d884ddb23 Patch1: CVE-2024-22195.patch # Security fix for CVE-2024-34064 @@ -48,8 +51,16 @@ Patch2: CVE-2024-34064.patch # Security fix for CVE-2024-56326 # Resolved upstream: https://github.com/pallets/jinja/commit/91a972f5808973cd441f4dc06873b2f8378f30c7 +# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=2333856 +# Patch backported from upstream without changelog and typing. Patch3: CVE-2024-56326.patch +# Security fix for CVE-2025-27516 +# Resolved upstream: https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403 +# Tracking bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-27516 +# Patch backported from upstream without changelog. +Patch4: CVE-2025-27516.patch + BuildArch: noarch %description @@ -147,6 +158,8 @@ environments. %patch1 -p1 %patch2 -p1 %patch3 -p1 +%patch4 -p1 + # cleanup find Jinja2-%{version} -name '*.pyo' -o -name '*.pyc' -delete @@ -254,17 +267,24 @@ popd %changelog -* Tue Jan 28 2025 wangzhe - 2.10.1-3.0.4 -- Fix CVE-2024-56326 +* Tue Apr 01 2025 mgb01105731 - 2.10.1-7.0.1 +- Add doc sub package -* Tue Jul 09 2024 songmingliang - 2.10.1-3.0.3 -- Fix CVE-2024-34064 +* Wed Mar 26 2025 Lumír Balhar - 2.10.1-7 +- Security fix for CVE-2025-27516 +Resolves: RHEL-85066 -* Fri Jun 07 2024 Kai Song - 2.10.1-3.0.2 -- Fix CVE-2024-22195 +* Wed Jan 22 2025 Lumír Balhar - 2.10.1-6 +- Security fix for CVE-2024-56326 +Resolves: RHEL-74677 -* Wed Jul 20 2022 mgb01105731 - 2.10.1-3.0.1 -- Add doc sub package +* Tue May 07 2024 Lumír Balhar - 2.10.1-5 +- Security fix for CVE-2024-34064 +Resolves: RHEL-35651 + +* Tue Jan 30 2024 Charalampos Stratakis - 2.10.1-4 +- Security fix for CVE-2024-22195 +Resolves: RHEL-21347 * Fri Mar 12 2021 Lumír Balhar - 2.10.1-3 - Fix CVE-2020-28493: ReDOS vulnerability due to the sub-pattern