In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
CVSS Details
- CVSS 3.1 Base Score: 8.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-jinja2 | May 4, 2022 | Apr 7, 2019 |
| Amazon Linux Ami 2 | — | Upgrade python3-jinja2 | Jun 26, 2024 | Apr 7, 2019 |
| Centos_linux | — | Upgrade python3-jinja2 | Aug 28, 2019 | Apr 7, 2019 |
| Debian | — | Upgrade jinja2 | Jul 30, 2024 | Apr 7, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-jinja2 | Sep 16, 2021 | Apr 7, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-jinja2 | Apr 30, 2021 | Apr 7, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-jinja2 | Feb 24, 2020 | Apr 7, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-jinja2Upgrade python3-jinja2 | Aug 28, 2019 | Apr 7, 2019 |
| Oracle Solaris | — | Upgrade library/python/urllib3-34 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko-27 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko-34 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2-27 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3-27 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-34 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3-35 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-27 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2-35 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/paramiko-35 to version 2.0.9-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2-34 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/urllib3 to version 1.25.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/jinja2 to version 2.10.1-11.4.11.0.1.3.0 on Solaris 11.4Upgrade library/python/lxml-35 to version 4.3.3-11.4.11.0.1.3.0 on Solaris 11.4 | Jul 17, 2019 | Apr 7, 2019 |
| Oracle_linux | — | Upgrade python3-jinja2 | Jul 22, 2024 | Apr 6, 2019 |
| Redhat_linux | — | Upgrade python3-jinja2 | May 14, 2019 | Apr 7, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Apr 7, 2019 |
| Suse | — | Upgrade python-Jinja2-emacsUpgrade python-Jinja2Upgrade python2-Jinja2Upgrade python3-Jinja2Upgrade python-Jinja2-vim | May 14, 2019 | Apr 6, 2019 |
| Ubuntu | — | Upgrade python3-jinja2 (Ubuntu Pro)Upgrade python-jinja2Upgrade python-jinja2 (Ubuntu Pro)Upgrade python3-jinja2 | Jun 6, 2019 | Apr 6, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub