Fix CVE-2014-1402 (using patch from RHSA-2014:0748).

python-jinja2.spec

@@ -10,12 +10,17 @@
 
 Name:		python-jinja2
 Version:	2.6
-Release:	6%{?dist}
+Release:	7%{?dist}
 Summary:	General purpose template engine
 Group:		Development/Languages
 License:	BSD
 URL:		http://jinja.pocoo.org/
 Source0:	http://pypi.python.org/packages/source/J/Jinja2/Jinja2-%{version}.tar.gz
+# This patch consists of two upstream patches merged and rebased
+# (the first upstream patch introduced CVE-2014-0012 and the second fixed it)
+# https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7
+# https://github.com/mitsuhiko/jinja2/pull/296/files
+Patch0:		Jinja2-2.6-fix-CVE-2014-1402.patch
 BuildRoot:	%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildArch:	noarch
 BuildRequires:	python-devel
@@ -69,6 +74,7 @@ environments.
 
 %prep
 %setup -q -n Jinja2-%{version}
+%patch0 -p0
 
 # cleanup
 find . -name '*.pyo' -o -name '*.pyc' -delete
@@ -155,6 +161,9 @@ popd
 
 
 %changelog
+* Fri Jun 13 2014 Thomas Moschny <thomas.moschny@gmx.de> - 2.6-7
+- Fix CVE-2014-1402 (using patch from RHSA-2014:0748).
+
 * Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.6-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild