83f1e6e201
Fixes the following security issue:
- CVE-2025-27516: Prior to 3.1.6, an oversight in how the Jinja
sandboxed environment interacts with the |attr filter allows
an attacker that controls the content of a template to execute
arbitrary Python code.
For more information, see:
- https://nvd.nist.gov/vuln/detail/CVE-2025-27516
- 90457bbf33
For more details on the version bump, see the release notes:
https://github.com/pallets/jinja/releases/tag/3.1.6
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2d5903769f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
22 lines
841 B
Makefile
22 lines
841 B
Makefile
################################################################################
|
|
#
|
|
# python-jinja2
|
|
#
|
|
################################################################################
|
|
|
|
PYTHON_JINJA2_VERSION = 3.1.6
|
|
PYTHON_JINJA2_SOURCE = jinja2-$(PYTHON_JINJA2_VERSION).tar.gz
|
|
PYTHON_JINJA2_SITE = https://files.pythonhosted.org/packages/df/bf/f7da0350254c0ed7c72f3e33cef02e048281fec7ecec5f032d4aac52226b
|
|
PYTHON_JINJA2_SETUP_TYPE = flit
|
|
PYTHON_JINJA2_LICENSE = BSD-3-Clause
|
|
PYTHON_JINJA2_LICENSE_FILES = LICENSE.txt
|
|
PYTHON_JINJA2_CPE_ID_VENDOR = pocoo
|
|
PYTHON_JINJA2_CPE_ID_PRODUCT = jinja2
|
|
|
|
# In host/target build, setup.py tries to download markupsafe if it is not installed
|
|
PYTHON_JINJA2_DEPENDENCIES = host-python-markupsafe
|
|
HOST_PYTHON_JINJA2_DEPENDENCIES = host-python-markupsafe
|
|
|
|
$(eval $(python-package))
|
|
$(eval $(host-python-package))
|