Name: CVE-2016-10745: Use of Externally-Controlled Format String
Creator: Rapid7
Published: 2019-04-08T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2016-10745, CWE-134, CVSS 8.6, EPSS 0.0352

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

CVSS Details

CVSS 3.1 Base Score: 8.6
CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Amazon Linux Ami 2	—	Upgrade python-jinja2	Apr 27, 2020	Apr 8, 2019
Amazon_linux	—	Upgrade python-jinja2	Jun 14, 2019	Apr 8, 2019
Centos_linux	—	Upgrade python-jinja2	May 15, 2019	Apr 8, 2019
Debian	—	Upgrade jinja2	Jul 30, 2024	Apr 8, 2019
Huawei Euleros 2_0_sp2	—	Upgrade python-jinja2	Jul 23, 2019	Apr 8, 2019
Huawei Euleros 2_0_sp3	—	Upgrade python-jinja2	Sep 25, 2019	Apr 8, 2019
Huawei Euleros 2_0_sp5	—	Upgrade python-jinja2	May 30, 2019	Apr 8, 2019
Oracle Solaris	—	Upgrade library/python/jinja2-34 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-35 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko-27 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2-27 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3-27 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko-35 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-27 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3-34 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3-35 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko-34 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-34 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2-35 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4	Dec 18, 2019	Apr 8, 2019
Oracle_linux	—	Upgrade python-jinja2	May 9, 2019	Dec 29, 2016
Redhat_linux	—	No solution existsUpgrade python-jinja2	May 8, 2019	Apr 8, 2019
Suse	—	Upgrade python3-Jinja2Upgrade python-Jinja2-vimUpgrade python-Jinja2Upgrade python2-Jinja2Upgrade python-Jinja2-emacs	May 14, 2019	Apr 8, 2019
Ubuntu	—	Upgrade python-jinja2Upgrade python3-jinja2Upgrade python3-jinja2 (Ubuntu Pro)Upgrade python-jinja2 (Ubuntu Pro)	Jun 6, 2019	Apr 8, 2019

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence