python3-jinja2: Jinja is an extensible templating engine

Jinja is an extensible templating engine. Prior to 3.1.5, An oversight inhow the Jinja sandboxed environment detects calls to str.format allows anattacker that controls the content of a template to execute arbitraryPython code. To exploit the vulnerability, an attacker needs to control thecontent of a template. Whether that is the case depends on the type ofapplication using Jinja. This vulnerability impacts users of applicationswhich execute untrusted templates. Jinja's sandbox does catch calls tostr.format and ensures they don't escape the sandbox. However, it'spossible to store a reference to a malicious string's format method, thenpass that to a filter that calls it. No such filters are built-in to Jinja,but could be present through custom filters in an application. After thefix, such indirect calls are also handled by the sandbox. Thisvulnerability is fixed in 3.1.5.

Where it's fixed