openSUSE Security Update : python-Jinja2 (openSUSE-2016-1159)

This script is Copyright (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote openSUSE host is missing a security update.

Description :

This update for python-Jinja2 fixes the following issues :

Update to version 2.8 :

- Added `target` parameter to urlize function.

- Added support for `followsymlinks` to the file system
loader.

- The truncate filter now counts the length.

- Added equalto filter that helps with select filters.

- Changed cache keys to use absolute file names if
available instead of load names.

- Fixed loop length calculation for some iterators.

- Changed how Jinja2 enforces strings to be native strings
in Python 2 to work when people break their default
encoding.

- Added :func:`make_logging_undefined` which returns an
undefined object that logs failures into a logger.

- If unmarshalling of cached data fails the template will
be reloaded now.

- Implemented a block ``set`` tag.

- Default cache size was incrased to 400 from a low 50.

- Fixed ``is number`` test to accept long integers in all
Python versions.

- Changed ``is number`` to accept Decimal as a number.

- Added a check for default arguments followed by
non-default arguments. This change makes ``{% macro m(x,
y=1, z) %}...{% endmacro %}`` a syntax error. The
previous behavior for this code was broken anyway
(resulting in the default value being applied to `y`).

- Add ability to use custom subclasses of
``jinja2.compiler.CodeGenerator`` and
``jinja2.runtime.Context`` by adding two new attributes
to the environment (`code_generator_class` and
`context_class`) (pull request ``#404``).

- added support for context/environment/evalctx decorator
functions on the finalize callback of the environment.

- escape query strings for urlencode properly. Previously
slashes were not escaped in that place.

- Add 'base' parameter to 'int' filter.

- Update to 2.7.3 (boo#858239, CVE-2014-0012)

See also :

https://bugzilla.opensuse.org/show_bug.cgi?id=858239

Solution :

Update the affected python-Jinja2 packages.

Risk factor :

Medium / CVSS Base Score : 4.4
(CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P)

Family: SuSE Local Security Checks

Nessus Plugin ID: 93995 ()

Bugtraq ID:

CVE ID: CVE-2014-0012

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now