Bug 58596 - jinja2: Multiple issues (5.2)
Summary: jinja2: Multiple issues (5.2)
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: Security updates
Version: UCS 5.2
Hardware: All Linux
: P3 normal
Target Milestone: UCS 5.2-3-errata
Assignee: Quality Assurance
QA Contact: Julia Bremer
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-09-10 10:52 CEST by Quality Assurance
Modified: 2025-09-17 14:08 CEST (History)
2 users (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2025-09-10 10:52:11 CEST 
New Debian jinja2 3.1.2-1+deb12u3 fixes:
This update addresses the following issues:
* jinja2: Jinja has a sandbox breakout through malicious filenames  (CVE-2024-56201)
* jinja2: Jinja has a sandbox breakout through indirect reference to format  method (CVE-2024-56326)
3.1.2-1+deb12u3 (Sun, 18 May 2025 00:17:01 +0200)
* CVE-2025-27516
Comment 1 Quality Assurance univentionstaff 2025-09-10 12:00:46 CEST 
--- mirror/ftp/pool/main/j/jinja2/jinja2_3.1.2-1+deb12u2.dsc
+++ apt/ucs_5.2-0-errata5.2-3/source/jinja2_3.1.2-1+deb12u3.dsc
@@ -1,3 +1,7 @@
+3.1.2-1+deb12u3 [Sun, 18 May 2025 00:17:01 +0200] Moritz Mühlenhoff <jmm@debian.org>:
+
+  * CVE-2025-27516 (Closes: #1099690)
+
 3.1.2-1+deb12u2 [Thu, 27 Feb 2025 22:30:54 +0100] Lee Garrett <debian@rocketjump.eu>:
 
   * Non-maintainer upload by the LTS security team.

<http://piuparts.knut.univention.de/5.2-3/#1792845769358902244>
Comment 2 Dirk Wiesenthal univentionstaff 2025-09-11 17:48:21 CEST 
OK: YAML
OK: Tests
OK: piuparts
Comment 3 Christian Castens univentionstaff 2025-09-17 14:08:52 CEST 
<https://errata.software-univention.de/#/?erratum=5.2x194>