Latest data: Fri Jan 10 08:06:41 UTC 2025

Homebrew · Jan 10, 2025 · a87ee68 · a87ee68
1 parent decb84e
commit a87ee68
Show file tree

Hide file tree

Showing 22 changed files with 114 additions and 54 deletions.
diff --git a/audits/aider-requirements.audit.json b/audits/aider-requirements.audit.json
@@ -24,8 +24,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -129,8 +131,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",

diff --git a/audits/ansible-lint-requirements.audit.json b/audits/ansible-lint-requirements.audit.json
@@ -24,8 +24,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -129,8 +131,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",

diff --git a/audits/certsync-requirements.audit.json b/audits/certsync-requirements.audit.json
@@ -24,8 +24,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -129,8 +131,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",

diff --git a/audits/charmcraft-requirements.audit.json b/audits/charmcraft-requirements.audit.json
@@ -24,8 +24,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -129,8 +131,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",

diff --git a/audits/gdbgui-requirements.audit.json b/audits/gdbgui-requirements.audit.json
@@ -286,8 +286,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -682,8 +684,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",

diff --git a/audits/gi-docgen-requirements.audit.json b/audits/gi-docgen-requirements.audit.json
@@ -24,8 +24,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -129,8 +131,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",

diff --git a/audits/harlequin-requirements.audit.json b/audits/harlequin-requirements.audit.json
@@ -24,8 +24,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -129,8 +131,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",

diff --git a/audits/libplacebo-requirements.audit.json b/audits/libplacebo-requirements.audit.json
@@ -24,8 +24,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -129,8 +131,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",

diff --git a/audits/litani-requirements.audit.json b/audits/litani-requirements.audit.json
@@ -24,8 +24,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -129,8 +131,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",

diff --git a/audits/mentat-requirements.audit.json b/audits/mentat-requirements.audit.json
@@ -390,8 +390,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -786,8 +788,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",

diff --git a/audits/organize-tool-requirements.audit.json b/audits/organize-tool-requirements.audit.json
@@ -24,8 +24,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -129,8 +131,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",

diff --git a/audits/pytorch-requirements.audit.json b/audits/pytorch-requirements.audit.json
@@ -24,8 +24,10 @@
           "CGA-gvvw-7w3r-7m54",
           "CGA-h79h-32w2-7vmp",
           "CGA-jjj9-fv4h-c9cv",
+          "CGA-jr6g-xxjr-rgc8",
           "CGA-mvqg-6j62-4pjm",
           "CGA-vj5f-6mc5-q329",
+          "CGA-w9xc-2j9j-8rrv",
           "CGA-whf8-42p9-686q"
         ],
         "summary": "Jinja has a sandbox breakout through malicious filenames",
@@ -129,8 +131,10 @@
           "CGA-f7wq-crqm-v76f",
           "CGA-gm37-p355-3fq6",
           "CGA-h3v9-xgx5-mrgr",
+          "CGA-hvm4-vp8w-6q8r",
           "CGA-p9v5-jpj2-q3ww",
-          "CGA-rx48-pgcw-gx64"
+          "CGA-rx48-pgcw-gx64",
+          "CGA-w2xv-8gr2-xp8m"
         ],
         "summary": "Jinja has a sandbox breakout through indirect reference to format method",
         "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",