In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-jinja2 | Apr 27, 2020 | Apr 8, 2019 |
| Amazon_linux | — | Upgrade python-jinja2 | Jun 14, 2019 | Apr 8, 2019 |
| Centos_linux | — | Upgrade python-jinja2 | May 15, 2019 | Apr 8, 2019 |
| Debian | — | Upgrade jinja2 | Jul 30, 2024 | Apr 8, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-jinja2 | Jul 23, 2019 | Apr 8, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-jinja2 | Sep 25, 2019 | Apr 8, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-jinja2 | May 30, 2019 | Apr 8, 2019 |
| Oracle Solaris | — | Upgrade library/python/urllib3-35 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2-35 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3-34 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-34 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko-34 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-35 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-27 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko-27 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko-35 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3-27 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2-27 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2-34 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4 | Dec 18, 2019 | Apr 8, 2019 |
| Oracle_linux | — | Upgrade python-jinja2 | May 9, 2019 | Dec 29, 2016 |
| Redhat_linux | — | Upgrade python-jinja2No solution exists | May 8, 2019 | Apr 8, 2019 |
| Suse | — | Upgrade python-Jinja2-emacsUpgrade python2-Jinja2Upgrade python-Jinja2-vimUpgrade python-Jinja2Upgrade python3-Jinja2 | May 14, 2019 | Apr 8, 2019 |
| Ubuntu | — | Upgrade python-jinja2Upgrade python3-jinja2 (Ubuntu Pro)Upgrade python3-jinja2Upgrade python-jinja2 (Ubuntu Pro) | Jun 6, 2019 | Apr 8, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub