From nobody Tue Aug 20 09:33:17 2024 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Wp45V0tZQz5SlJY; Tue, 20 Aug 2024 09:33:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Wp45V0G2Fz46qw; Tue, 20 Aug 2024 09:33:18 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1724146398; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=is8OKo6FUG1cT0ayfWoSSF4ZwqVM1Sl1uhY/n6K56TM=; b=v/fmIcj6lgTzSocWabBy2FNKPMcxAWshtjNw1Fzj44DOi9jx8xK8o5Peq06t355JnyKMyd xo0zcUpjJPYMdiIBE4CGjei1mz+zHdJyMAZIQdxMZ4/ENmdwSxpqtXxJpZhXAfsWshxM/9 lBj3U3v7iC39vlYmEAb77pzr7/3XldXWUyZjEKcPmzZZC0uFnu3TFqL2fF7uJhQGl4UqN/ vST+cWUCYucyu6NNn/1VcBbyPnBgUt6JHE5xaXYQSJr/YcqGOs8yXSf+ci/irtfvRbwqKZ sZ7Pf4jSVfQRuspAqityzK60aakH0fYYsnT54fYAWu5+gngb51wW5YLYQilcQw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1724146398; a=rsa-sha256; cv=none; b=vbM74Lb7vuu6Zouc3RDJboPBmGj/l2ATZowoN58CfBDNYinhY2Cy0k1Me5kk5tceKJdW/u ktLvVE8SBdKUZxLD5Pxyh/6Op80xbivkMGIhRcO9ugtFyWqQKWjFsQW0bT+KgqhCgzwZQJ qS41A6p6K+v9PbhfLXGIuS5K3rsSFMtT4/vcPJHs+4Gnb9JEb35W7MiAAqQAjLlj8uk5y+ zcEA8a3/4RcPPzO1z33q0UbQXfDON2nyui+Vlw4ezEn95kEuOdBvcxsR0eRtdFiLD7Td/P 0lTMRSu+YBNqkA3GXEn0c5Slq1C4mQimwjD/jFPcrndmeG4Ar156TKDQv3IWgg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1724146398; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=is8OKo6FUG1cT0ayfWoSSF4ZwqVM1Sl1uhY/n6K56TM=; b=VuAx/SJEbeYN+68xl2wiFMVayYUZDVX+GJRUlv7PvL5ROrjkjmhb61oeJraVF20T+NlZid b1fquQlrBMCsf8kqpzMpuREWIGN/AgG48jFdCEiwR8KrVriVFX7wv6ibaS04jlID1kSmJK TgnP2GUswwLoYQnecV5wCgkj3MVMYBw8DiCKXpnfflBrDuiGxjczXn28pCIWD6MhxFoz/a qAGCWA4VjE9XcEV3sPYkg710zkHByhYtd9YDZDA6y9F4gWSgzv1G5JU2tIe9Nmi/aq+/zw 8Gdqp7AcwwmRWzfFygAMgSCYWf4RKwLo1uCjy2tRX1FcnimpY4253zAUmfmSBg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Wp45T6vQpzvnW; Tue, 20 Aug 2024 09:33:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 47K9XHv7031836; Tue, 20 Aug 2024 09:33:17 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 47K9XHYq031833; Tue, 20 Aug 2024 09:33:17 GMT (envelope-from git) Date: Tue, 20 Aug 2024 09:33:17 GMT Message-Id: <202408200933.47K9XHYq031833@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Nicola Vitale Subject: git: cab7616c17ce - main - security/vuxml: Add devel/py-Jinja2 <= 3.1.3 List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-all@freebsd.org Sender: owner-dev-commits-ports-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: nivit X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: cab7616c17ce593a96608ccdbb080a2d1a973a41 Auto-Submitted: auto-generated The branch main has been updated by nivit: URL: https://cgit.FreeBSD.org/ports/commit/?id=cab7616c17ce593a96608ccdbb080a2d1a973a41 commit cab7616c17ce593a96608ccdbb080a2d1a973a41 Author: Nicola Vitale AuthorDate: 2024-08-20 09:20:48 +0000 Commit: Nicola Vitale CommitDate: 2024-08-20 09:20:48 +0000 security/vuxml: Add devel/py-Jinja2 <= 3.1.3 Reference: https://github.com/advisories/GHSA-h75v-3vvj-5mfj PR: 279350 --- security/vuxml/vuln/2024.xml | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 1fa93858ab61..182c9cbc4d5f 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,45 @@ + + Jinja2 -- Vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter + + + py38-Jinja2 + py39-Jinja2 + py310-Jinja2 + py311-Jinja2 + 3.1.4 + + + + +

security-advisories@github.com reports:

+
+

Jinja is an extensible templating engine. The `xmlattr` filter in + affected versions of Jinja accepts keys containing non-attribute + characters. XML/HTML attributes cannot contain spaces, `/`, `>`, + or `=`, as each would then be interpreted as starting a separate + attribute. If an application accepts keys (as opposed to only + values) as user input, and renders these in pages that other users + see as well, an attacker could use this to inject other attributes + and perform XSS. The fix for CVE-2024-22195 only addressed spaces + but not other characters. Accepting keys as user input is now + explicitly considered an unintended use case of the `xmlattr` filter, + and code that does so without otherwise validating the input should + be flagged as insecure, regardless of Jinja version. Accepting + _values_ as user input continues to be safe. This vulnerability + is fixed in 3.1.4.

+
+ + + + CVE-2024-34064 + https://nvd.nist.gov/vuln/detail/CVE-2024-34064 + + + 2024-05-06 + 2024-08-20 + + + mozilla products -- spoofing attack