jinja2 (2.10.1-2ubuntu0.6) focal-security; urgency=medium

  * SECURITY REGRESSION: Arbitrary code execution via |attr filter bypass
    - debian/patches/CVE-2025-27516.patch: Replace getattr_static with an
      equivalent Python 2 compatible function
    - CVE-2025-27516

 -- John Breton <john.breton@canonical.com>  Wed, 12 Mar 2025 12:53:04 -0400

jinja2 (2.10.1-2ubuntu0.5) focal-security; urgency=medium

  * SECURITY UPDATE: Arbitrary code execution via |attr filter bypass
    - debian/patches/CVE-2025-27516.patch: attr filter uses env.getattr
    - CVE-2025-27516

 -- John Breton <john.breton@canonical.com>  Mon, 10 Mar 2025 12:58:01 -0400

jinja2 (2.10.1-2ubuntu0.4) focal-security; urgency=medium

  * SECURITY UPDATE: arbitrary code execution issue in jinja compiler
    - debian/patches/CVE-2024-56201.patch: f-string syntax handling in code
      generation improved in jinja2/compiler.py.
    - debian/patches/CVE-2024-56326.patch: oversight on calls to str.format
      adjusted in jinja2/sandbox.py.
    - CVE-2024-56201
    - CVE-2024-56326

 -- Evan Caville <evan.caville@canonical.com>  Mon, 06 Jan 2025 15:47:03 +1000

jinja2 (2.10.1-2ubuntu0.3) focal-security; urgency=medium

  * SECURITY UPDATE: Cross-Site scripting in xmlattr filter
    - debian/patches/CVE-2024-34064.patch: disallow invalid characters 
      in keys to xmlattr filter
    - CVE-2024-34064

 -- Nick Galanis <nick.galanis@canonical.com>  Tue, 21 May 2024 09:35:36 +0100

jinja2 (2.10.1-2ubuntu0.2) focal-security; urgency=medium

  * SECURITY UPDATE: regular expression DoS
    - debian/patches/CVE-2020-28493.patch: rewrite regex match for
      punctuation in urlize() in jinja2/utils.py.
    - CVE-2020-28493
  * SECURITY UPDATE: Cross-Site scripting
    - debian/patches/CVE-2024-22195.patch: disallow keys with spaces
      in jinja2/filters.py, tests/test_filters.py.
    - CVE-2024-22195

 -- Leonidas Da Silva Barbosa <leo.barbosa@canonical.com>  Mon, 22 Jan 2024 07:14:05 -0300

jinja2 (2.10.1-2) unstable; urgency=medium

  [ Ondřej Nový ]
  * Use debhelper-compat instead of debian/compat.
  * Bump Standards-Version to 4.4.1.

  [ Thomas Goirand ]
  * Team upload.
  * Add py3.9-fix-collections-import.patch (Closes: #949018).

 -- Thomas Goirand <zigo@debian.org>  Thu, 27 Feb 2020 11:49:32 +0100

jinja2 (2.10.1-1) unstable; urgency=medium

  [ Ondřej Nový ]
  * d/control: Set Vcs-* to salsa.debian.org
  * d/changelog: Remove trailing whitespaces
  * d/control: Remove ancient X-Python-Version field
  * d/control: Remove ancient X-Python3-Version field
  * Convert git repository from git-dpm to gbp layout

  [ Piotr Ożarowski ]
  * New upstream release
  * Standards-version bumped to 4.4.0 (no other changes needed)

 -- Piotr Ożarowski <piotr@debian.org>  Wed, 10 Jul 2019 22:34:15 +0200

jinja2 (2.10-2) unstable; urgency=high

  [ Thomas Goirand ]
  * CVE-2019-10906: In Pallets Jinja before 2.10.1, str.format_map allows a
    sandbox escape. Applied upstream patch: sandbox_str.format_map.patch
    (Closes: #926602).

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 09 Apr 2019 21:58:20 +0200

jinja2 (2.10-1) unstable; urgency=medium

  * New upstream release
  * Add python3-sphinx to Build-Depends and invoke dh_sphinxdoc after building
    documentation
  * Standards-version bumped to 4.1.1
    - -doc package's Priority changed to optional

 -- Piotr Ożarowski <piotr@debian.org>  Thu, 30 Nov 2017 10:54:37 +0100

jinja2 (2.9.6-1) unstable; urgency=medium

  [ Piotr Ożarowski ]
  * New upstream release
  * Install CHANGES file as upstream changelog (closes: 857722)
  * Standards-version bumped to 4.0.0 (no other changes needed)

  [ Michael Hudson-Doyle ]
  * Install asyncsupport.py and asyncfilters.py now that Python 3.6 is a
    supported version (but do not compile them on install with Python 3.5).
    (closes: 862699)

 -- Piotr Ożarowski <piotr@debian.org>  Tue, 20 Jun 2017 15:21:18 +0200

# For older changelog entries, run 'apt-get changelog python-jinja2'
