ALT-BU-2024-4717-1
Branch p10_e2k update bulletin.
Package python3-module-pycryptodomex updated to version 3.20.0-alt1 for branch p10_e2k.
Closed bugs
>= 3.19.1
Package python3-module-GitPython updated to version 3.1.42-alt0.p10.1 for branch p10_e2k.
Closed bugs
>= 3.1.41
Closed bugs
Нет файлов локализации.
нет русской локализации в интерфейсе uget
Package python3-module-jinja2 updated to version 3.0.1-alt1.p10.1 for branch p10_e2k.
Closed vulnerabilities
BDU:2024-00884
Уязвимость фильтра xmlattr шаблонизатора Jinja2 для языка программирования Python, позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)
Modified: 2025-02-13
CVE-2024-22195
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
- https://github.com/pallets/jinja/releases/tag/3.1.3
- https://github.com/pallets/jinja/releases/tag/3.1.3
- https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95
- https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95
- https://lists.debian.org/debian-lts-announce/2024/01/msg00010.html
- https://lists.debian.org/debian-lts-announce/2024/01/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3/
Closed bugs
Игнорировать reason-phrase по http