search

sarvex / mongo

The Mongo Database
http://www.mongodb.org/
Other
0 stars 0 forks source link

Update dependency jinja2 to v3.1.4 [SECURITY] - autoclosed #85

Closed renovate[bot] closed 3 months ago

renovate[bot] commented 3 months ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
jinja2 (changelog) 3.1.3 -> 3.1.4 age adoption passing confidence

[!WARNING] Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2024-34064

The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, >, or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.

Accepting keys as user input is now explicitly considered an unintended use case of the xmlattr filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting values as user input continues to be safe.

Release Notes

pallets/jinja (jinja2) ### [`v3.1.4`](https://togithub.com/pallets/jinja/blob/HEAD/CHANGES.rst#Version-314) [Compare Source](https://togithub.com/pallets/jinja/compare/3.1.3...3.1.4) Released 2024-05-05 - The `xmlattr` filter does not allow keys with `/` solidus, `>` greater-than sign, or `=` equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. :ghsa:`h75v-3vvj-5mfj`

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.

github-actions[bot] commented 3 months ago

🦙 MegaLinter status: ❌ ERROR

Descriptor Linter Files Fixed Errors Elapsed time
❌ ACTION actionlint 2 1 0.12s
⚠️ BASH bash-exec 354 109 1.1s
❌ BASH shellcheck 354 4942 83.87s
⚠️ BASH shfmt 354 313 1 1.48s
❌ COPYPASTE jscpd yes 1 5426.5s
❌ CSS stylelint 6 6 1 2.83s
❌ DOCKERFILE hadolint 12 1 1.03s
❌ HTML djlint 38 1 4.86s
❌ HTML htmlhint 38 2392 0.99s
❌ JAVASCRIPT eslint 6139 0 1 62.64s
❌ JAVASCRIPT standard 6139 6115 1 631.72s
❌ JSON jsonlint 232 1 0.47s
❌ JSON npm-package-json-lint yes 1 1.94s
✅ JSON prettier 232 139 0 5.39s
❌ JSON v8r 232 1 277.03s
⚠️ MARKDOWN markdownlint 269 227 1167 21.99s
❌ MARKDOWN markdown-link-check 269 19 16.89s
✅ MARKDOWN markdown-table-formatter 269 229 0 1.97s
❌ PROTOBUF protolint 162 103 3 153.18s
❌ REPOSITORY checkov yes 65 237.78s
❌ REPOSITORY gitleaks yes 1231 748.32s
❌ REPOSITORY git_diff yes 1 3.91s
❌ REPOSITORY grype yes 1 15.86s
❌ REPOSITORY secretlint yes 1 10194.37s
❌ REPOSITORY trivy yes 1 12.93s
✅ REPOSITORY trivy-sbom yes no 2.15s
✅ REPOSITORY trufflehog yes no 72.36s
❌ SPELL cspell 40759 1108486 21113.4s
❌ SPELL lychee 5676 1 11.0s
✅ XML xmllint 41 0 0 1.07s
⚠️ YAML prettier 662 512 1 23.13s
❌ YAML v8r 662 1 497.71s
❌ YAML yamllint 662 1 24.61s

See detailed report in MegaLinter reports

_MegaLinter is graciously provided by OX Security_