openSUSE Security Update : python-Jinja2 (openSUSE-2016-1159)

Medium Nessus Plugin ID 93995


The remote openSUSE host is missing a security update.


This update for python-Jinja2 fixes the following issues :

Update to version 2.8 :

- Added `target` parameter to urlize function.

- Added support for `followsymlinks` to the file system loader.

- The truncate filter now counts the length.

- Added equalto filter that helps with select filters.

- Changed cache keys to use absolute file names if available instead of load names.

- Fixed loop length calculation for some iterators.

- Changed how Jinja2 enforces strings to be native strings in Python 2 to work when people break their default encoding.

- Added :func:`make_logging_undefined` which returns an undefined object that logs failures into a logger.

- If unmarshalling of cached data fails the template will be reloaded now.

- Implemented a block ``set`` tag.

- Default cache size was incrased to 400 from a low 50.

- Fixed ``is number`` test to accept long integers in all Python versions.

- Changed ``is number`` to accept Decimal as a number.

- Added a check for default arguments followed by non-default arguments. This change makes ``{% macro m(x, y=1, z) %}...{% endmacro %}`` a syntax error. The previous behavior for this code was broken anyway (resulting in the default value being applied to `y`).

- Add ability to use custom subclasses of ``jinja2.compiler.CodeGenerator`` and ``jinja2.runtime.Context`` by adding two new attributes to the environment (`code_generator_class` and `context_class`) (pull request ``#404``).

- added support for context/environment/evalctx decorator functions on the finalize callback of the environment.

- escape query strings for urlencode properly. Previously slashes were not escaped in that place.

- Add 'base' parameter to 'int' filter.

- Update to 2.7.3 (boo#858239, CVE-2014-0012)


Update the affected python-Jinja2 packages.

See Also

Plugin Details

Severity: Medium

ID: 93995

File Name: openSUSE-2016-1159.nasl

Version: $Revision: 2.1 $

Type: local

Agent: unix

Published: 2016/10/12

Modified: 2016/10/12

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 4.4

Vector: CVSS2#AV:L/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:python-Jinja2, p-cpe:/a:novell:opensuse:python-Jinja2-emacs, p-cpe:/a:novell:opensuse:python-Jinja2-vim, cpe:/o:novell:opensuse:13.2

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 2016/10/06

Reference Information

CVE: CVE-2014-0012