jinja2 (3.1.2-1+deb12u2) bookworm; urgency=medium * Non-maintainer upload by the LTS security team. * Fix CVE-2024-56201: In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. * Fix CVE-2024-56326: Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. -- Lee Garrett Thu, 27 Feb 2025 22:30:54 +0100 jinja2 (3.1.2-1+deb12u1) bookworm; urgency=medium * Non-maintainer upload. * CVE-2024-22195: HTML attribute injection (Closes: #1060748) * CVE-2024-34064: HTML attribute injection (Closes: #1070712) -- Adrian Bunk Sat, 07 Dec 2024 19:15:36 +0200 jinja2 (3.1.2-1) unstable; urgency=medium [ Thomas Goirand ] * Add python3-pytest as build-depends (now run tests at build time). * Add autopkgtest. [ Piotr Ożarowski ] * New upstream release (closes: 1025808, 1023637) * Add 0003-fix-nose-leftovers patch * Bump minimum required python3-pallets-sphinx-themes build dependency (closes: 1005864) -- Piotr Ożarowski Fri, 24 Feb 2023 16:15:45 +0100 jinja2 (3.0.3-2) unstable; urgency=medium * Team upload. * Downgrading python3-babel from depends to recommends (Closes: #1019580). -- Thomas Goirand Tue, 13 Sep 2022 10:26:29 +0200 jinja2 (3.0.3-1) unstable; urgency=medium * New upstream release -- Piotr Ożarowski Fri, 11 Feb 2022 13:50:47 +0100 jinja2 (3.0.1-2) unstable; urgency=medium * Uploading to unstable. -- Thomas Goirand Fri, 01 Oct 2021 11:22:02 +0200 jinja2 (3.0.1-1) experimental; urgency=medium [ Debian Janitor ] * Remove constraints unnecessary since stretch: + Build-Depends: Drop versioned constraint on python-setuptools. [ Thomas Goirand ] * Team upload. * New upstream release. * Ran wrap-and-sort -bastk. * Fixed (build-)depends for this release. * Killed the python2 package. * Rebase patches: - re-wrote py3.9-fix-collections-import.patch - refreshed 0002-docs-disable-sphinxcontrib.log_cabinet.patch * Use debian/jinja.vim instead of the one upstream, gone in this version. -- Thomas Goirand Fri, 17 Sep 2021 23:25:00 +0200 jinja2 (2.11.3-1) unstable; urgency=medium * Team upload. [ Ondřej Nový ] * d/control: Update Vcs-* fields with new Debian Python Team Salsa layout. [ Debian Janitor ] * Apply multi-arch hints. + python-jinja2-doc: Add Multi-Arch: foreign. [ Sandro Tosi ] * Use the new Debian Python Team contact name and address [ Hans-Christoph Steiner ] * New upstream release -- Hans-Christoph Steiner Mon, 01 Mar 2021 12:05:52 +0100 jinja2 (2.11.2-1) unstable; urgency=medium * New upstream release -- Piotr Ożarowski Thu, 04 Jun 2020 19:31:21 +0200 jinja2 (2.11.1-1) unstable; urgency=medium [ Thomas Goirand ] * py3.9-fix-collections-import.patch: correctly "except ImportError:" everywhere in the patch. [ Salman Mohammadi ] * d/control: change python-jinja2-doc to recommend python3-jinja2 (closes: 951672) [ Piotr Ożarowski ] * New upstream release * Add python3-pallets-sphinx-themes and python3-sphinx-issues to Build-Depends * Add patch to disable sphinxcontrib.log_cabinet for now as it's not packaged in Debian yet (versionadded, versionchanged, deprecated directives in changelog will not be used) * Move Vim syntax files to python3-jinja2 package * Standards-version bumped to 4.5.0 (no other changes needed) -- Piotr Ożarowski Thu, 02 Apr 2020 13:35:21 +0200 jinja2 (2.10.1-2) unstable; urgency=medium [ Ondřej Nový ] * Use debhelper-compat instead of debian/compat. * Bump Standards-Version to 4.4.1. [ Thomas Goirand ] * Team upload. * Add py3.9-fix-collections-import.patch (Closes: #949018). -- Thomas Goirand Thu, 27 Feb 2020 11:49:32 +0100 jinja2 (2.10.1-1) unstable; urgency=medium [ Ondřej Nový ] * d/control: Set Vcs-* to salsa.debian.org * d/changelog: Remove trailing whitespaces * d/control: Remove ancient X-Python-Version field * d/control: Remove ancient X-Python3-Version field * Convert git repository from git-dpm to gbp layout [ Piotr Ożarowski ] * New upstream release * Standards-version bumped to 4.4.0 (no other changes needed) -- Piotr Ożarowski Wed, 10 Jul 2019 22:34:15 +0200 jinja2 (2.10-2) unstable; urgency=high [ Thomas Goirand ] * CVE-2019-10906: In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape. Applied upstream patch: sandbox_str.format_map.patch (Closes: #926602). -- Piotr Ożarowski Tue, 09 Apr 2019 21:58:20 +0200 jinja2 (2.10-1) unstable; urgency=medium * New upstream release * Add python3-sphinx to Build-Depends and invoke dh_sphinxdoc after building documentation * Standards-version bumped to 4.1.1 - -doc package's Priority changed to optional -- Piotr Ożarowski Thu, 30 Nov 2017 10:54:37 +0100 jinja2 (2.9.6-1) unstable; urgency=medium [ Piotr Ożarowski ] * New upstream release * Install CHANGES file as upstream changelog (closes: 857722) * Standards-version bumped to 4.0.0 (no other changes needed) [ Michael Hudson-Doyle ] * Install asyncsupport.py and asyncfilters.py now that Python 3.6 is a supported version (but do not compile them on install with Python 3.5). (closes: 862699) -- Piotr Ożarowski Tue, 20 Jun 2017 15:21:18 +0200 jinja2 (2.9.5-1) unstable; urgency=medium * New upstream release - restores original repr of the internal _GroupTuple which fixes ansible (closes: 851741) -- Piotr Ożarowski Tue, 07 Feb 2017 22:27:54 +0100 jinja2 (2.9.4-1) unstable; urgency=medium [ Ondřej Nový ] * Fixed VCS URL (https) [ Piotr Ożarowski ] * New upstream release - do not install async* files, they require Python >= 3.6 * Standards-version bumped to 3.9.8 (no other changes needed) -- Piotr Ożarowski Tue, 10 Jan 2017 20:28:57 +0100 jinja2 (2.8-1) unstable; urgency=medium * New upstream release - drop jinja2-typos and drop_next_import_from_docs-jinjaext patches - both applied upstream * rewrite debian/rules to dh sequencer and pybuild buildsystem * Standards-version bumped to 3.9.6 (no other changes needed) -- Piotr Ożarowski Sat, 01 Aug 2015 14:15:36 +0200 jinja2 (2.7.3-1) unstable; urgency=medium * New upstream release * Drop fix_CVE-2014-0012.patch (better fix applied upstream) * Homepage updated -- Piotr Ożarowski Tue, 10 Jun 2014 20:44:26 +0200 jinja2 (2.7.2-2) unstable; urgency=high * Add fix_CVE-2014-1402 patch which uses tempfile.mkdtemp to create cache dir (closes: 734956) -- Piotr Ożarowski Sun, 12 Jan 2014 15:09:04 +0100 jinja2 (2.7.2-1) unstable; urgency=high * New upstream release - changes default folder for the filesystem cache (closes: 734747, CVE-2014-1402) -- Piotr Ożarowski Fri, 10 Jan 2014 20:56:20 +0100 jinja2 (2.7.1-1) unstable; urgency=low * New upstream release -- Piotr Ożarowski Thu, 08 Aug 2013 22:25:01 +0200 jinja2 (2.7-3) unstable; urgency=low [ Jakub Wilk ] * Restore Python 3.2 compatibility (closes: #709638) * Fix bunch of typos in the documentation (closes: #679534) -- Piotr Ożarowski Sat, 25 May 2013 23:07:10 +0200 jinja2 (2.7-2) unstable; urgency=low * Relax build dependency on python3-all and hardcode python3-jinja2's Depends and postinst maintainer script (temporary fix, closes: #709390) -- Piotr Ożarowski Thu, 23 May 2013 18:42:20 +0200 jinja2 (2.7-1) unstable; urgency=low [ Jakub Wilk ] * Use canonical URIs for Vcs-* fields. [ Piotr Ożarowski ] * New upstream release - minimum required Python version bumped to 2.6 and 3.3 * debugsupport extension no longer available, Architecture changed to "all" * Bump minimum required python3-all version in Build-Depends (to generate versioned py3compile -V in maintainer script) * Add patches/drop_next_import_from_docs-jinjaext.patch to fix building docs * Use dh_sphinxdoc to handle JavaScript libraries used in -doc package * Standards-Version bumped to 3.9.4 - add build-arch and build-indep targets * debian/compat changed to 9 -- Piotr Ożarowski Mon, 20 May 2013 21:15:37 +0200 jinja2 (2.6-1) unstable; urgency=low * New upstream release * add_version_placeholder patch removed (no longer needed) * htmljinja.vim is no longer available, use jinja.vim instead * python3-jinja2 suggests python-jinja2-doc instead of python3-jinja2-doc * Standards-version bumped to 3.9.2 (no other changes needed) -- Piotr Ożarowski Mon, 25 Jul 2011 10:31:24 +0200 jinja2 (2.5.5-5) unstable; urgency=low * Drop hardcoded python3.1 from Depends (closes: #621816) * Do not compress objects.inv file (closes: #608757) -- Piotr Ożarowski Fri, 15 Apr 2011 22:05:53 +0200 jinja2 (2.5.5-4) unstable; urgency=low * Upload to unstable (closes: 621001) * Lower versions of build dependencies (to the ones from 2.5.5-1) * Convert from dh_pysupport to dh_python2 * Change source format to 3.0 (quilt), drop quilt build dependency -- Piotr Ożarowski Tue, 05 Apr 2011 23:21:21 +0200 jinja2 (2.5.5-3) experimental; urgency=low * Bump minimum required python-support version to the one in experimental to get Python 2.7 support (closes: 608149) -- Piotr Ożarowski Mon, 27 Dec 2010 23:15:04 +0100 jinja2 (2.5.5-2) experimental; urgency=low * Rebuild for Python 2.7 and 3.2 extension (minimum required python-all's version temporary bumped to 2.6.6-4, python-setuptools' to 0.6.14-5 and python3-all's to 3.1.2-14 to make sure the right version from experimental will be used). Closes: 607450. * Update debian/rules to handle Python >= 3.2 -- Piotr Ożarowski Tue, 21 Dec 2010 20:58:19 +0100 jinja2 (2.5.5-1) unstable; urgency=low * New upstream release -- Piotr Ożarowski Tue, 19 Oct 2010 08:34:49 +0200 jinja2 (2.5.4-1) unstable; urgency=low * New upstream release -- Piotr Ożarowski Sun, 17 Oct 2010 20:48:21 +0200 jinja2 (2.5.2-3) unstable; urgency=low * Rebuild against newer python3-all-dev package (python3.1 now uses /usr/lib/python3/), minimum python3-all version bumped to 3.1.2-10 * Use python3's python.mk * Drop python3-jinja2.{postinst,prerm} maintainer scripts, dh_python3 will generate them -- Piotr Ożarowski Sun, 26 Sep 2010 21:19:54 +0200 jinja2 (2.5.2-2) unstable; urgency=low * Really remove _markupsafe -- Piotr Ożarowski Thu, 19 Aug 2010 09:24:47 +0200 jinja2 (2.5.2-1) unstable; urgency=low * New upstream release - speedups module moved to separate package: MarkupSafe * python-markupsafe added to Depends (jinja2._markupsafe removed from the package) * debian/control: python3-jinja2 binary package updated to latest changes in dh_python3 * Standards-version bumped to 3.9.1 (no other changes needed) -- Piotr Ożarowski Wed, 18 Aug 2010 11:29:44 +0200 jinja2 (2.5-1) unstable; urgency=low * New upstream release * python3_builtins.patch removed, no longer needed * add python3.1 to python3-jinja2's Depends -- Piotr Ożarowski Sun, 30 May 2010 11:01:51 +0200 jinja2 (2.4.1-1) unstable; urgency=low * New upstream release * Add python3_builtins.patch taken from upstream repo (Different name for builtins in Python 3) -- Piotr Ożarowski Tue, 20 Apr 2010 19:51:16 +0200 jinja2 (2.4-3) unstable; urgency=low * Add missing maintainer scripts in python3-jinja2 package -- Piotr Ożarowski Sun, 18 Apr 2010 17:15:49 +0200 jinja2 (2.4-2) unstable; urgency=low * Add Python 3 support, new binary packages: python3-jinja2 and python3-jinja2-dbg -- Piotr Ożarowski Tue, 13 Apr 2010 20:44:43 +0200 jinja2 (2.4-1) unstable; urgency=low * New upstream release -- Piotr Ożarowski Tue, 13 Apr 2010 19:52:05 +0200 jinja2 (2.3.1-1) unstable; urgency=low * New upstream release * Move python-pybabel from Recommends to Enhances -- Piotr Ożarowski Fri, 19 Feb 2010 18:31:52 +0100 jinja2 (2.3-1) unstable; urgency=low * New upstream release * Hardcode __version__ at build time, no need to use pkg_resources (Closes: #548062) * Standards-version bumped to 3.8.4 (no other changes needed) -- Piotr Ożarowski Wed, 10 Feb 2010 22:06:28 +0100 jinja2 (2.2.1-1) unstable; urgency=low * New upstream release -- Piotr Ożarowski Tue, 15 Sep 2009 19:38:47 +0200 jinja2 (2.2-1) unstable; urgency=low [ Jakub Wilk ] * Build depend on Sphinx >= 0.6 (due to changes_for_sphinx_0.6 patch) [ Piotr Ożarowski ] * New upstream release (Closes: #536227) * No longer needed patches: - changes_for_sphinx_0.6.patch - dont_install_docs_via_setup_py.patch * pass --with-speedups to setup.py (building extension is now disabled by default in upstream code) * debian/copyright file updated * Standards-version bumped to 3.8.3 (no other changes needed) -- Piotr Ożarowski Sun, 13 Sep 2009 16:44:18 +0200 jinja2 (2.1.1-3) unstable; urgency=low * Documentation builds fine with new Sphinx now, thanks to Jakub Wilk for the patch (Closes: #527486) * Standards-version bumped to 3.8.2: - python-jinja2-dbg's section changed to debug * Support /usr/local/*/dist-packages in debian/rules (python2.6 will need it) -- Piotr Ożarowski Wed, 08 Jul 2009 21:40:46 +0200 jinja2 (2.1.1-2) unstable; urgency=low * Install Vim syntax files in /usr/share/vim/addons/syntax/ Use `vim-addons install jinja` to enable it (Closes: 514046) * Upload to unstable -- Piotr Ożarowski Tue, 10 Feb 2009 19:59:56 +0100 jinja2 (2.1.1-1) experimental; urgency=low * New upstream release * Build depend on Sphinx >= 0.5.1 + remove_non_ascii_char patch removed -- Piotr Ożarowski Thu, 25 Dec 2008 19:10:36 +0100 jinja2 (2.1-1) experimental; urgency=low [ Sandro Tosi ] * Switch Vcs-Browser field to viewsvn [ Piotr Ożarowski ] * New upstream release * Bump required python-sphinx version to >= 0.5 (needed to build docs) + upload to experimental (Sphinx 0.5 is in experimental for now) * Add remove_non_ascii_char patch (to workaround docutils/Sphinx bug) -- Piotr Ożarowski Sun, 30 Nov 2008 20:14:33 +0100 jinja2 (2.0-2) unstable; urgency=low * Recommend python-pybabel instead of python-babel (Closes: #501725) -- Piotr Ożarowski Thu, 09 Oct 2008 22:43:11 +0200 jinja2 (2.0-1) unstable; urgency=low * Initial release (this package is an successor of jinja package) -- Piotr Ożarowski Sun, 20 Jul 2008 23:01:02 +0200