Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2016-10745 (GCVE-0-2016-10745)
Vulnerability from cvelistv5 – Published: 2019-04-08 13:00 – Updated: 2024-08-06 03:30- n/a
| URL | Tags |
|---|---|
| https://palletsprojects.com/blog/jinja-281-released/ | x_refsource_MISC |
| https://github.com/pallets/jinja/commit/9b53045c3… | x_refsource_MISC |
| https://access.redhat.com/errata/RHSA-2019:1022 | vendor-advisoryx_refsource_REDHAT |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| https://access.redhat.com/errata/RHSA-2019:1237 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:1260 | vendor-advisoryx_refsource_REDHAT |
| https://usn.ubuntu.com/4011-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://usn.ubuntu.com/4011-2/ | vendor-advisoryx_refsource_UBUNTU |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| https://access.redhat.com/errata/RHSA-2019:3964 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:4062 | vendor-advisoryx_refsource_REDHAT |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T03:30:20.200Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://palletsprojects.com/blog/jinja-281-released/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"
},
{
"name": "RHSA-2019:1022",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1022"
},
{
"name": "openSUSE-SU-2019:1395",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"name": "RHSA-2019:1237",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1237"
},
{
"name": "RHSA-2019:1260",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1260"
},
{
"name": "USN-4011-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4011-1/"
},
{
"name": "USN-4011-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4011-2/"
},
{
"name": "openSUSE-SU-2019:1614",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
},
{
"name": "RHSA-2019:3964",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:3964"
},
{
"name": "RHSA-2019:4062",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4062"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-12-03T13:06:04.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://palletsprojects.com/blog/jinja-281-released/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"
},
{
"name": "RHSA-2019:1022",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1022"
},
{
"name": "openSUSE-SU-2019:1395",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"name": "RHSA-2019:1237",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1237"
},
{
"name": "RHSA-2019:1260",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:1260"
},
{
"name": "USN-4011-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/4011-1/"
},
{
"name": "USN-4011-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/4011-2/"
},
{
"name": "openSUSE-SU-2019:1614",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
},
{
"name": "RHSA-2019:3964",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:3964"
},
{
"name": "RHSA-2019:4062",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:4062"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-10745",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://palletsprojects.com/blog/jinja-281-released/",
"refsource": "MISC",
"url": "https://palletsprojects.com/blog/jinja-281-released/"
},
{
"name": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16",
"refsource": "MISC",
"url": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"
},
{
"name": "RHSA-2019:1022",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:1022"
},
{
"name": "openSUSE-SU-2019:1395",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"name": "RHSA-2019:1237",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:1237"
},
{
"name": "RHSA-2019:1260",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:1260"
},
{
"name": "USN-4011-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4011-1/"
},
{
"name": "USN-4011-2",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4011-2/"
},
{
"name": "openSUSE-SU-2019:1614",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
},
{
"name": "RHSA-2019:3964",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:3964"
},
{
"name": "RHSA-2019:4062",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:4062"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-10745",
"datePublished": "2019-04-08T13:00:48.000Z",
"dateReserved": "2019-04-08T00:00:00.000Z",
"dateUpdated": "2024-08-06T03:30:20.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2016-10745",
"date": "2026-05-20",
"epss": "0.01022",
"percentile": "0.7748"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.8.1\", \"matchCriteriaId\": \"4BD6AB58-BD65-43FC-BDE9-D528F436ADA6\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.\"}, {\"lang\": \"es\", \"value\": \"En Pallets Jinja versiones anteriores a 2.8.1, str.format permite un scape de sandbox\"}]",
"id": "CVE-2016-10745",
"lastModified": "2024-11-21T02:44:39.103",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"baseScore\": 8.6, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 4.0}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2019-04-08T13:29:00.280",
"references": "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:1022\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:1237\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:1260\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:3964\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:4062\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://palletsprojects.com/blog/jinja-281-released/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://usn.ubuntu.com/4011-1/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://usn.ubuntu.com/4011-2/\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:1022\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:1237\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:1260\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:3964\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2019:4062\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://palletsprojects.com/blog/jinja-281-released/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://usn.ubuntu.com/4011-1/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://usn.ubuntu.com/4011-2/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-134\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2016-10745\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-04-08T13:29:00.280\",\"lastModified\":\"2024-11-21T02:44:39.103\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.\"},{\"lang\":\"es\",\"value\":\"En Pallets Jinja versiones anteriores a 2.8.1, str.format permite un scape de sandbox\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":4.0}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-134\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.8.1\",\"matchCriteriaId\":\"4BD6AB58-BD65-43FC-BDE9-D528F436ADA6\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1022\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1237\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1260\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3964\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:4062\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://palletsprojects.com/blog/jinja-281-released/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4011-1/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://usn.ubuntu.com/4011-2/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1022\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1237\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1260\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:3964\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:4062\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://palletsprojects.com/blog/jinja-281-released/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://usn.ubuntu.com/4011-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://usn.ubuntu.com/4011-2/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
CERTFR-2024-AVI-0366
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
None| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Cloud Pak | IBM Cloud Pak for Security versions 1.10.x.x antérieures à 1.10.21.0 | ||
| IBM | QRadar Suite Software | QRadar Suite Software versions 1.10.x.x antérieures à 1.10.21.0 | ||
| IBM | QRadar Assistant | QRadar Assistant versions antérieures à 3.7.0 | ||
| IBM | Cognos Analytics | Cognos Analytics versions 12.0.x antérieures à 12.0.3 | ||
| IBM | QRadar SIEM | QRadar SIEM sur Azure Marketplace versions antérieures à 7.3.x postérieures à 7.3.3 et antérieures à 7.5.0 avec le paquet OMI installé | ||
| IBM | WebSphere | WebSphere eXtreme Scale versions 8.6.1.x antérieures à 8.6.1.6 sans le correctif de sécurité PH61029 | ||
| IBM | Cognos Analytics | Cognos Analytics versions 11.2.x FP2 antérieures à 11.2.4 FP3 |
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Cloud Pak for Security versions 1.10.x.x ant\u00e9rieures \u00e0 1.10.21.0",
"product": {
"name": "Cloud Pak",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Suite Software versions 1.10.x.x ant\u00e9rieures \u00e0 1.10.21.0",
"product": {
"name": "QRadar Suite Software",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Assistant versions ant\u00e9rieures \u00e0 3.7.0",
"product": {
"name": "QRadar Assistant",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Cognos Analytics versions 12.0.x ant\u00e9rieures \u00e0 12.0.3",
"product": {
"name": "Cognos Analytics",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar SIEM sur Azure Marketplace versions ant\u00e9rieures \u00e0 7.3.x post\u00e9rieures \u00e0 7.3.3 et ant\u00e9rieures \u00e0 7.5.0 avec le paquet OMI install\u00e9",
"product": {
"name": "QRadar SIEM",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere eXtreme Scale versions 8.6.1.x ant\u00e9rieures \u00e0 8.6.1.6 sans le correctif de s\u00e9curit\u00e9 PH61029",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Cognos Analytics versions 11.2.x FP2 ant\u00e9rieures \u00e0 11.2.4 FP3",
"product": {
"name": "Cognos Analytics",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-25577",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25577"
},
{
"name": "CVE-2022-31116",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31116"
},
{
"name": "CVE-2023-28841",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28841"
},
{
"name": "CVE-2024-28849",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28849"
},
{
"name": "CVE-2023-28840",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28840"
},
{
"name": "CVE-2023-45857",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45857"
},
{
"name": "CVE-2021-30465",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-30465"
},
{
"name": "CVE-2022-29162",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29162"
},
{
"name": "CVE-2022-31117",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31117"
},
{
"name": "CVE-2023-23934",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23934"
},
{
"name": "CVE-2023-27561",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27561"
},
{
"name": "CVE-2024-28102",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28102"
},
{
"name": "CVE-2019-14322",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14322"
},
{
"name": "CVE-2023-44270",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44270"
},
{
"name": "CVE-2023-34462",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-34462"
},
{
"name": "CVE-2019-1010083",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1010083"
},
{
"name": "CVE-2018-18074",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-18074"
},
{
"name": "CVE-2022-23541",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23541"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2022-40897",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40897"
},
{
"name": "CVE-2023-5072",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5072"
},
{
"name": "CVE-2024-21503",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21503"
},
{
"name": "CVE-2022-23540",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23540"
},
{
"name": "CVE-2024-1135",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1135"
},
{
"name": "CVE-2024-21501",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21501"
},
{
"name": "CVE-2024-22195",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22195"
},
{
"name": "CVE-2021-43784",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43784"
},
{
"name": "CVE-2023-28842",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28842"
},
{
"name": "CVE-2024-29131",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29131"
},
{
"name": "CVE-2024-21334",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21334"
},
{
"name": "CVE-2023-25809",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25809"
},
{
"name": "CVE-2016-10745",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10745"
},
{
"name": "CVE-2023-46136",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46136"
},
{
"name": "CVE-2024-29133",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29133"
},
{
"name": "CVE-2023-44981",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44981"
},
{
"name": "CVE-2024-27088",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27088"
},
{
"name": "CVE-2022-23539",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23539"
},
{
"name": "CVE-2018-1000656",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000656"
},
{
"name": "CVE-2024-25047",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25047"
},
{
"name": "CVE-2021-28363",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28363"
},
{
"name": "CVE-2020-15366",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15366"
},
{
"name": "CVE-2015-3627",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3627"
},
{
"name": "CVE-2023-31484",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31484"
},
{
"name": "CVE-2023-28642",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28642"
},
{
"name": "CVE-2016-10516",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10516"
},
{
"name": "CVE-2020-25032",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25032"
},
{
"name": "CVE-2021-45958",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45958"
},
{
"name": "CVE-2023-30861",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30861"
},
{
"name": "CVE-2021-43565",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43565"
},
{
"name": "CVE-2023-32681",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32681"
},
{
"name": "CVE-2020-28493",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28493"
},
{
"name": "CVE-2023-26159",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26159"
},
{
"name": "CVE-2024-24758",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24758"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0366",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-05-03T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0\ndistance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7149736 du 29 avril 2024",
"url": "https://www.ibm.com/support/pages/node/7149736"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7150045 du 01 mai 2024",
"url": "https://www.ibm.com/support/pages/node/7150045"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7149967 du 01 mai 2024",
"url": "https://www.ibm.com/support/pages/node/7149967"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7149874 du 01 mai 2024",
"url": "https://www.ibm.com/support/pages/node/7149874"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7150150 du 03 mai 2024",
"url": "https://www.ibm.com/support/pages/node/7150150"
}
]
}
CERTFR-2024-AVI-0366
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
None| Vendor | Product | Description | ||
|---|---|---|---|---|
| IBM | Cloud Pak | IBM Cloud Pak for Security versions 1.10.x.x antérieures à 1.10.21.0 | ||
| IBM | QRadar Suite Software | QRadar Suite Software versions 1.10.x.x antérieures à 1.10.21.0 | ||
| IBM | QRadar Assistant | QRadar Assistant versions antérieures à 3.7.0 | ||
| IBM | Cognos Analytics | Cognos Analytics versions 12.0.x antérieures à 12.0.3 | ||
| IBM | QRadar SIEM | QRadar SIEM sur Azure Marketplace versions antérieures à 7.3.x postérieures à 7.3.3 et antérieures à 7.5.0 avec le paquet OMI installé | ||
| IBM | WebSphere | WebSphere eXtreme Scale versions 8.6.1.x antérieures à 8.6.1.6 sans le correctif de sécurité PH61029 | ||
| IBM | Cognos Analytics | Cognos Analytics versions 11.2.x FP2 antérieures à 11.2.4 FP3 |
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "IBM Cloud Pak for Security versions 1.10.x.x ant\u00e9rieures \u00e0 1.10.21.0",
"product": {
"name": "Cloud Pak",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Suite Software versions 1.10.x.x ant\u00e9rieures \u00e0 1.10.21.0",
"product": {
"name": "QRadar Suite Software",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar Assistant versions ant\u00e9rieures \u00e0 3.7.0",
"product": {
"name": "QRadar Assistant",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Cognos Analytics versions 12.0.x ant\u00e9rieures \u00e0 12.0.3",
"product": {
"name": "Cognos Analytics",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "QRadar SIEM sur Azure Marketplace versions ant\u00e9rieures \u00e0 7.3.x post\u00e9rieures \u00e0 7.3.3 et ant\u00e9rieures \u00e0 7.5.0 avec le paquet OMI install\u00e9",
"product": {
"name": "QRadar SIEM",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "WebSphere eXtreme Scale versions 8.6.1.x ant\u00e9rieures \u00e0 8.6.1.6 sans le correctif de s\u00e9curit\u00e9 PH61029",
"product": {
"name": "WebSphere",
"vendor": {
"name": "IBM",
"scada": false
}
}
},
{
"description": "Cognos Analytics versions 11.2.x FP2 ant\u00e9rieures \u00e0 11.2.4 FP3",
"product": {
"name": "Cognos Analytics",
"vendor": {
"name": "IBM",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-25577",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25577"
},
{
"name": "CVE-2022-31116",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31116"
},
{
"name": "CVE-2023-28841",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28841"
},
{
"name": "CVE-2024-28849",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28849"
},
{
"name": "CVE-2023-28840",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28840"
},
{
"name": "CVE-2023-45857",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45857"
},
{
"name": "CVE-2021-30465",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-30465"
},
{
"name": "CVE-2022-29162",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29162"
},
{
"name": "CVE-2022-31117",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-31117"
},
{
"name": "CVE-2023-23934",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23934"
},
{
"name": "CVE-2023-27561",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27561"
},
{
"name": "CVE-2024-28102",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28102"
},
{
"name": "CVE-2019-14322",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14322"
},
{
"name": "CVE-2023-44270",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44270"
},
{
"name": "CVE-2023-34462",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-34462"
},
{
"name": "CVE-2019-1010083",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-1010083"
},
{
"name": "CVE-2018-18074",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-18074"
},
{
"name": "CVE-2022-23541",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23541"
},
{
"name": "CVE-2023-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
},
{
"name": "CVE-2022-40897",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-40897"
},
{
"name": "CVE-2023-5072",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-5072"
},
{
"name": "CVE-2024-21503",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21503"
},
{
"name": "CVE-2022-23540",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23540"
},
{
"name": "CVE-2024-1135",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1135"
},
{
"name": "CVE-2024-21501",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21501"
},
{
"name": "CVE-2024-22195",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-22195"
},
{
"name": "CVE-2021-43784",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43784"
},
{
"name": "CVE-2023-28842",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28842"
},
{
"name": "CVE-2024-29131",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29131"
},
{
"name": "CVE-2024-21334",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21334"
},
{
"name": "CVE-2023-25809",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-25809"
},
{
"name": "CVE-2016-10745",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10745"
},
{
"name": "CVE-2023-46136",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-46136"
},
{
"name": "CVE-2024-29133",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-29133"
},
{
"name": "CVE-2023-44981",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44981"
},
{
"name": "CVE-2024-27088",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-27088"
},
{
"name": "CVE-2022-23539",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23539"
},
{
"name": "CVE-2018-1000656",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000656"
},
{
"name": "CVE-2024-25047",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25047"
},
{
"name": "CVE-2021-28363",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-28363"
},
{
"name": "CVE-2020-15366",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-15366"
},
{
"name": "CVE-2015-3627",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-3627"
},
{
"name": "CVE-2023-31484",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-31484"
},
{
"name": "CVE-2023-28642",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-28642"
},
{
"name": "CVE-2016-10516",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10516"
},
{
"name": "CVE-2020-25032",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25032"
},
{
"name": "CVE-2021-45958",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-45958"
},
{
"name": "CVE-2023-30861",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-30861"
},
{
"name": "CVE-2021-43565",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-43565"
},
{
"name": "CVE-2023-32681",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32681"
},
{
"name": "CVE-2020-28493",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28493"
},
{
"name": "CVE-2023-26159",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-26159"
},
{
"name": "CVE-2024-24758",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24758"
}
],
"links": [],
"reference": "CERTFR-2024-AVI-0366",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-05-03T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans \u003cspan\nclass=\"textit\"\u003eles produits IBM\u003c/span\u003e. Certaines d\u0027entre elles\npermettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0\ndistance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7149736 du 29 avril 2024",
"url": "https://www.ibm.com/support/pages/node/7149736"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7150045 du 01 mai 2024",
"url": "https://www.ibm.com/support/pages/node/7150045"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7149967 du 01 mai 2024",
"url": "https://www.ibm.com/support/pages/node/7149967"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7149874 du 01 mai 2024",
"url": "https://www.ibm.com/support/pages/node/7149874"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 IBM 7150150 du 03 mai 2024",
"url": "https://www.ibm.com/support/pages/node/7150150"
}
]
}
FKIE_CVE-2016-10745
Vulnerability from fkie_nvd - Published: 2019-04-08 13:29 - Updated: 2024-11-21 02:44| Vendor | Product | Version | |
|---|---|---|---|
| palletsprojects | jinja | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4BD6AB58-BD65-43FC-BDE9-D528F436ADA6",
"versionEndExcluding": "2.8.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape."
},
{
"lang": "es",
"value": "En Pallets Jinja versiones anteriores a 2.8.1, str.format permite un scape de sandbox"
}
],
"id": "CVE-2016-10745",
"lastModified": "2024-11-21T02:44:39.103",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-04-08T13:29:00.280",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
},
{
"source": "cve@mitre.org",
"url": "https://access.redhat.com/errata/RHSA-2019:1022"
},
{
"source": "cve@mitre.org",
"url": "https://access.redhat.com/errata/RHSA-2019:1237"
},
{
"source": "cve@mitre.org",
"url": "https://access.redhat.com/errata/RHSA-2019:1260"
},
{
"source": "cve@mitre.org",
"url": "https://access.redhat.com/errata/RHSA-2019:3964"
},
{
"source": "cve@mitre.org",
"url": "https://access.redhat.com/errata/RHSA-2019:4062"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://palletsprojects.com/blog/jinja-281-released/"
},
{
"source": "cve@mitre.org",
"url": "https://usn.ubuntu.com/4011-1/"
},
{
"source": "cve@mitre.org",
"url": "https://usn.ubuntu.com/4011-2/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2019:1022"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2019:1237"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2019:1260"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2019:3964"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://access.redhat.com/errata/RHSA-2019:4062"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://palletsprojects.com/blog/jinja-281-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://usn.ubuntu.com/4011-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://usn.ubuntu.com/4011-2/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-134"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-HJ2J-77XM-MC5V
Vulnerability from github – Published: 2019-04-10 14:30 – Updated: 2024-09-24 20:51In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Jinja2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-10745"
],
"database_specific": {
"cwe_ids": [
"CWE-134"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:40:24Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.",
"id": "GHSA-hj2j-77xm-mc5v",
"modified": "2024-09-24T20:51:38Z",
"published": "2019-04-10T14:30:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10745"
},
{
"type": "WEB",
"url": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1022"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1237"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1260"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3964"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:4062"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-hj2j-77xm-mc5v"
},
{
"type": "PACKAGE",
"url": "https://github.com/pallets/jinja"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2019-220.yaml"
},
{
"type": "WEB",
"url": "https://palletsprojects.com/blog/jinja-281-released"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4011-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4011-2"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Jinja2 sandbox escape vulnerability"
}
GSD-2016-10745
Vulnerability from gsd - Updated: 2023-12-13 01:21{
"GSD": {
"alias": "CVE-2016-10745",
"description": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.",
"id": "GSD-2016-10745",
"references": [
"https://www.suse.com/security/cve/CVE-2016-10745.html",
"https://access.redhat.com/errata/RHSA-2019:4062",
"https://access.redhat.com/errata/RHSA-2019:3964",
"https://access.redhat.com/errata/RHSA-2019:3172",
"https://access.redhat.com/errata/RHSA-2019:1260",
"https://access.redhat.com/errata/RHSA-2019:1237",
"https://access.redhat.com/errata/RHSA-2019:1022",
"https://ubuntu.com/security/CVE-2016-10745",
"https://advisories.mageia.org/CVE-2016-10745.html",
"https://alas.aws.amazon.com/cve/html/CVE-2016-10745.html",
"https://linux.oracle.com/cve/CVE-2016-10745.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2016-10745"
],
"details": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.",
"id": "GSD-2016-10745",
"modified": "2023-12-13T01:21:26.937629Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-10745",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://palletsprojects.com/blog/jinja-281-released/",
"refsource": "MISC",
"url": "https://palletsprojects.com/blog/jinja-281-released/"
},
{
"name": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16",
"refsource": "MISC",
"url": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"
},
{
"name": "RHSA-2019:1022",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:1022"
},
{
"name": "openSUSE-SU-2019:1395",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"name": "RHSA-2019:1237",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:1237"
},
{
"name": "RHSA-2019:1260",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:1260"
},
{
"name": "USN-4011-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4011-1/"
},
{
"name": "USN-4011-2",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/4011-2/"
},
{
"name": "openSUSE-SU-2019:1614",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
},
{
"name": "RHSA-2019:3964",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:3964"
},
{
"name": "RHSA-2019:4062",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:4062"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c2.8.1",
"affected_versions": "All versions before 2.8.1",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-134",
"CWE-937"
],
"date": "2021-09-14",
"description": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.",
"fixed_versions": [
"2.8.1"
],
"identifier": "CVE-2016-10745",
"identifiers": [
"GHSA-hj2j-77xm-mc5v",
"CVE-2016-10745"
],
"not_impacted": "All versions starting from 2.8.1",
"package_slug": "pypi/Jinja2",
"pubdate": "2019-04-10",
"solution": "Upgrade to version 2.8.1 or above.",
"title": "Use of Externally-Controlled Format String",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2016-10745",
"https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16",
"https://access.redhat.com/errata/RHSA-2019:1022",
"https://access.redhat.com/errata/RHSA-2019:1237",
"https://access.redhat.com/errata/RHSA-2019:1260",
"https://access.redhat.com/errata/RHSA-2019:3964",
"https://access.redhat.com/errata/RHSA-2019:4062",
"https://github.com/advisories/GHSA-hj2j-77xm-mc5v",
"https://palletsprojects.com/blog/jinja-281-released/",
"https://usn.ubuntu.com/4011-1/",
"https://usn.ubuntu.com/4011-2/",
"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
],
"uuid": "db196e91-7fc4-4b94-93b3-e0c0dc01bcbe"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.8.1",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-10745"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-134"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://palletsprojects.com/blog/jinja-281-released/",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://palletsprojects.com/blog/jinja-281-released/"
},
{
"name": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16",
"refsource": "MISC",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"
},
{
"name": "RHSA-2019:1022",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2019:1022"
},
{
"name": "openSUSE-SU-2019:1395",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"name": "RHSA-2019:1237",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2019:1237"
},
{
"name": "RHSA-2019:1260",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2019:1260"
},
{
"name": "USN-4011-1",
"refsource": "UBUNTU",
"tags": [],
"url": "https://usn.ubuntu.com/4011-1/"
},
{
"name": "USN-4011-2",
"refsource": "UBUNTU",
"tags": [],
"url": "https://usn.ubuntu.com/4011-2/"
},
{
"name": "openSUSE-SU-2019:1614",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
},
{
"name": "RHSA-2019:3964",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2019:3964"
},
{
"name": "RHSA-2019:4062",
"refsource": "REDHAT",
"tags": [],
"url": "https://access.redhat.com/errata/RHSA-2019:4062"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0
}
},
"lastModifiedDate": "2019-06-06T16:29Z",
"publishedDate": "2019-04-08T13:29Z"
}
}
}
OPENSUSE-SU-2019:1395-1
Vulnerability from csaf_opensuse - Published: 2019-05-13 13:01 - Updated: 2019-05-13 13:01| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch | — |
Vendor Fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-Jinja2",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-Jinja2 to version 2.10.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-8341: Fixed a command injection in from_string() (bsc#1125815).\n- CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format (bsc#1132323).\n\nThis update was imported from the SUSE:SLE-15:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2019-1395",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_1395-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2019:1395-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPV2O2QPXQEQ5BKRBRQ2RKA7RHVLTZ7E/#KPV2O2QPXQEQ5BKRBRQ2RKA7RHVLTZ7E"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2019:1395-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KPV2O2QPXQEQ5BKRBRQ2RKA7RHVLTZ7E/#KPV2O2QPXQEQ5BKRBRQ2RKA7RHVLTZ7E"
},
{
"category": "self",
"summary": "SUSE Bug 1125815",
"url": "https://bugzilla.suse.com/1125815"
},
{
"category": "self",
"summary": "SUSE Bug 1132174",
"url": "https://bugzilla.suse.com/1132174"
},
{
"category": "self",
"summary": "SUSE Bug 1132323",
"url": "https://bugzilla.suse.com/1132323"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-10745 page",
"url": "https://www.suse.com/security/cve/CVE-2016-10745/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-10906 page",
"url": "https://www.suse.com/security/cve/CVE-2019-10906/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-8341 page",
"url": "https://www.suse.com/security/cve/CVE-2019-8341/"
}
],
"title": "Security update for python-Jinja2",
"tracking": {
"current_release_date": "2019-05-13T13:01:56Z",
"generator": {
"date": "2019-05-13T13:01:56Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2019:1395-1",
"initial_release_date": "2019-05-13T13:01:56Z",
"revision_history": [
{
"date": "2019-05-13T13:01:56Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"product": {
"name": "python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"product_id": "python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch"
}
},
{
"category": "product_version",
"name": "python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"product": {
"name": "python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"product_id": "python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch"
}
},
{
"category": "product_version",
"name": "python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"product": {
"name": "python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"product_id": "python2-Jinja2-2.10.1-lp150.2.3.1.noarch"
}
},
{
"category": "product_version",
"name": "python3-Jinja2-2.10.1-lp150.2.3.1.noarch",
"product": {
"name": "python3-Jinja2-2.10.1-lp150.2.3.1.noarch",
"product_id": "python3-Jinja2-2.10.1-lp150.2.3.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.0",
"product": {
"name": "openSUSE Leap 15.0",
"product_id": "openSUSE Leap 15.0",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch as component of openSUSE Leap 15.0",
"product_id": "openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch"
},
"product_reference": "python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch as component of openSUSE Leap 15.0",
"product_id": "openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch"
},
"product_reference": "python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python2-Jinja2-2.10.1-lp150.2.3.1.noarch as component of openSUSE Leap 15.0",
"product_id": "openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch"
},
"product_reference": "python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-Jinja2-2.10.1-lp150.2.3.1.noarch as component of openSUSE Leap 15.0",
"product_id": "openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch"
},
"product_reference": "python3-Jinja2-2.10.1-lp150.2.3.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10745",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-10745"
}
],
"notes": [
{
"category": "general",
"text": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-10745",
"url": "https://www.suse.com/security/cve/CVE-2016-10745"
},
{
"category": "external",
"summary": "SUSE Bug 1132174 for CVE-2016-10745",
"url": "https://bugzilla.suse.com/1132174"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-05-13T13:01:56Z",
"details": "important"
}
],
"title": "CVE-2016-10745"
},
{
"cve": "CVE-2019-10906",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-10906"
}
],
"notes": [
{
"category": "general",
"text": "In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-10906",
"url": "https://www.suse.com/security/cve/CVE-2019-10906"
},
{
"category": "external",
"summary": "SUSE Bug 1132323 for CVE-2019-10906",
"url": "https://bugzilla.suse.com/1132323"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-05-13T13:01:56Z",
"details": "important"
}
],
"title": "CVE-2019-10906"
},
{
"cve": "CVE-2019-8341",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-8341"
}
],
"notes": [
{
"category": "general",
"text": "** DISPUTED ** An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the \"source\" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn\u0027t valid because users shouldn\u0027t use untrusted templates without sandboxing.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-8341",
"url": "https://www.suse.com/security/cve/CVE-2019-8341"
},
{
"category": "external",
"summary": "SUSE Bug 1125815 for CVE-2019-8341",
"url": "https://bugzilla.suse.com/1125815"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.0:python-Jinja2-emacs-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python-Jinja2-vim-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python2-Jinja2-2.10.1-lp150.2.3.1.noarch",
"openSUSE Leap 15.0:python3-Jinja2-2.10.1-lp150.2.3.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-05-13T13:01:56Z",
"details": "important"
}
],
"title": "CVE-2019-8341"
}
]
}
OPENSUSE-SU-2024:11208-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64 | — |
Vendor Fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "python36-Jinja2-3.0.1-3.2 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the python36-Jinja2-3.0.1-3.2 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-11208",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11208-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0012 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0012/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-10745 page",
"url": "https://www.suse.com/security/cve/CVE-2016-10745/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-10906 page",
"url": "https://www.suse.com/security/cve/CVE-2019-10906/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-28493 page",
"url": "https://www.suse.com/security/cve/CVE-2020-28493/"
}
],
"title": "python36-Jinja2-3.0.1-3.2 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:11208-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python36-Jinja2-3.0.1-3.2.aarch64",
"product": {
"name": "python36-Jinja2-3.0.1-3.2.aarch64",
"product_id": "python36-Jinja2-3.0.1-3.2.aarch64"
}
},
{
"category": "product_version",
"name": "python38-Jinja2-3.0.1-3.2.aarch64",
"product": {
"name": "python38-Jinja2-3.0.1-3.2.aarch64",
"product_id": "python38-Jinja2-3.0.1-3.2.aarch64"
}
},
{
"category": "product_version",
"name": "python39-Jinja2-3.0.1-3.2.aarch64",
"product": {
"name": "python39-Jinja2-3.0.1-3.2.aarch64",
"product_id": "python39-Jinja2-3.0.1-3.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "python36-Jinja2-3.0.1-3.2.ppc64le",
"product": {
"name": "python36-Jinja2-3.0.1-3.2.ppc64le",
"product_id": "python36-Jinja2-3.0.1-3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "python38-Jinja2-3.0.1-3.2.ppc64le",
"product": {
"name": "python38-Jinja2-3.0.1-3.2.ppc64le",
"product_id": "python38-Jinja2-3.0.1-3.2.ppc64le"
}
},
{
"category": "product_version",
"name": "python39-Jinja2-3.0.1-3.2.ppc64le",
"product": {
"name": "python39-Jinja2-3.0.1-3.2.ppc64le",
"product_id": "python39-Jinja2-3.0.1-3.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "python36-Jinja2-3.0.1-3.2.s390x",
"product": {
"name": "python36-Jinja2-3.0.1-3.2.s390x",
"product_id": "python36-Jinja2-3.0.1-3.2.s390x"
}
},
{
"category": "product_version",
"name": "python38-Jinja2-3.0.1-3.2.s390x",
"product": {
"name": "python38-Jinja2-3.0.1-3.2.s390x",
"product_id": "python38-Jinja2-3.0.1-3.2.s390x"
}
},
{
"category": "product_version",
"name": "python39-Jinja2-3.0.1-3.2.s390x",
"product": {
"name": "python39-Jinja2-3.0.1-3.2.s390x",
"product_id": "python39-Jinja2-3.0.1-3.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "python36-Jinja2-3.0.1-3.2.x86_64",
"product": {
"name": "python36-Jinja2-3.0.1-3.2.x86_64",
"product_id": "python36-Jinja2-3.0.1-3.2.x86_64"
}
},
{
"category": "product_version",
"name": "python38-Jinja2-3.0.1-3.2.x86_64",
"product": {
"name": "python38-Jinja2-3.0.1-3.2.x86_64",
"product_id": "python38-Jinja2-3.0.1-3.2.x86_64"
}
},
{
"category": "product_version",
"name": "python39-Jinja2-3.0.1-3.2.x86_64",
"product": {
"name": "python39-Jinja2-3.0.1-3.2.x86_64",
"product_id": "python39-Jinja2-3.0.1-3.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python36-Jinja2-3.0.1-3.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64"
},
"product_reference": "python36-Jinja2-3.0.1-3.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python36-Jinja2-3.0.1-3.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le"
},
"product_reference": "python36-Jinja2-3.0.1-3.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python36-Jinja2-3.0.1-3.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x"
},
"product_reference": "python36-Jinja2-3.0.1-3.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python36-Jinja2-3.0.1-3.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64"
},
"product_reference": "python36-Jinja2-3.0.1-3.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python38-Jinja2-3.0.1-3.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64"
},
"product_reference": "python38-Jinja2-3.0.1-3.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python38-Jinja2-3.0.1-3.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le"
},
"product_reference": "python38-Jinja2-3.0.1-3.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python38-Jinja2-3.0.1-3.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x"
},
"product_reference": "python38-Jinja2-3.0.1-3.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python38-Jinja2-3.0.1-3.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64"
},
"product_reference": "python38-Jinja2-3.0.1-3.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python39-Jinja2-3.0.1-3.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64"
},
"product_reference": "python39-Jinja2-3.0.1-3.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python39-Jinja2-3.0.1-3.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le"
},
"product_reference": "python39-Jinja2-3.0.1-3.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python39-Jinja2-3.0.1-3.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x"
},
"product_reference": "python39-Jinja2-3.0.1-3.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python39-Jinja2-3.0.1-3.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
},
"product_reference": "python39-Jinja2-3.0.1-3.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-0012",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0012"
}
],
"notes": [
{
"category": "general",
"text": "FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user\u0027s uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0012",
"url": "https://www.suse.com/security/cve/CVE-2014-0012"
},
{
"category": "external",
"summary": "SUSE Bug 858239 for CVE-2014-0012",
"url": "https://bugzilla.suse.com/858239"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2014-0012"
},
{
"cve": "CVE-2016-10745",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-10745"
}
],
"notes": [
{
"category": "general",
"text": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-10745",
"url": "https://www.suse.com/security/cve/CVE-2016-10745"
},
{
"category": "external",
"summary": "SUSE Bug 1132174 for CVE-2016-10745",
"url": "https://bugzilla.suse.com/1132174"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-10745"
},
{
"cve": "CVE-2019-10906",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-10906"
}
],
"notes": [
{
"category": "general",
"text": "In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-10906",
"url": "https://www.suse.com/security/cve/CVE-2019-10906"
},
{
"category": "external",
"summary": "SUSE Bug 1132323 for CVE-2019-10906",
"url": "https://bugzilla.suse.com/1132323"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2019-10906"
},
{
"cve": "CVE-2020-28493",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-28493"
}
],
"notes": [
{
"category": "general",
"text": "This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-28493",
"url": "https://www.suse.com/security/cve/CVE-2020-28493"
},
{
"category": "external",
"summary": "SUSE Bug 1181944 for CVE-2020-28493",
"url": "https://bugzilla.suse.com/1181944"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python36-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python38-Jinja2-3.0.1-3.2.x86_64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.aarch64",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.ppc64le",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.s390x",
"openSUSE Tumbleweed:python39-Jinja2-3.0.1-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-28493"
}
]
}
OPENSUSE-SU-2024:13930-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64 | — |
Vendor Fix
|
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "python310-Jinja2-3.1.4-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the python310-Jinja2-3.1.4-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-13930",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13930-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2014-0012 page",
"url": "https://www.suse.com/security/cve/CVE-2014-0012/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-10745 page",
"url": "https://www.suse.com/security/cve/CVE-2016-10745/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-10906 page",
"url": "https://www.suse.com/security/cve/CVE-2019-10906/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-28493 page",
"url": "https://www.suse.com/security/cve/CVE-2020-28493/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-34064 page",
"url": "https://www.suse.com/security/cve/CVE-2024-34064/"
}
],
"title": "python310-Jinja2-3.1.4-1.1 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:13930-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python310-Jinja2-3.1.4-1.1.aarch64",
"product": {
"name": "python310-Jinja2-3.1.4-1.1.aarch64",
"product_id": "python310-Jinja2-3.1.4-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "python311-Jinja2-3.1.4-1.1.aarch64",
"product": {
"name": "python311-Jinja2-3.1.4-1.1.aarch64",
"product_id": "python311-Jinja2-3.1.4-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "python312-Jinja2-3.1.4-1.1.aarch64",
"product": {
"name": "python312-Jinja2-3.1.4-1.1.aarch64",
"product_id": "python312-Jinja2-3.1.4-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "python310-Jinja2-3.1.4-1.1.ppc64le",
"product": {
"name": "python310-Jinja2-3.1.4-1.1.ppc64le",
"product_id": "python310-Jinja2-3.1.4-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "python311-Jinja2-3.1.4-1.1.ppc64le",
"product": {
"name": "python311-Jinja2-3.1.4-1.1.ppc64le",
"product_id": "python311-Jinja2-3.1.4-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "python312-Jinja2-3.1.4-1.1.ppc64le",
"product": {
"name": "python312-Jinja2-3.1.4-1.1.ppc64le",
"product_id": "python312-Jinja2-3.1.4-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "python310-Jinja2-3.1.4-1.1.s390x",
"product": {
"name": "python310-Jinja2-3.1.4-1.1.s390x",
"product_id": "python310-Jinja2-3.1.4-1.1.s390x"
}
},
{
"category": "product_version",
"name": "python311-Jinja2-3.1.4-1.1.s390x",
"product": {
"name": "python311-Jinja2-3.1.4-1.1.s390x",
"product_id": "python311-Jinja2-3.1.4-1.1.s390x"
}
},
{
"category": "product_version",
"name": "python312-Jinja2-3.1.4-1.1.s390x",
"product": {
"name": "python312-Jinja2-3.1.4-1.1.s390x",
"product_id": "python312-Jinja2-3.1.4-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "python310-Jinja2-3.1.4-1.1.x86_64",
"product": {
"name": "python310-Jinja2-3.1.4-1.1.x86_64",
"product_id": "python310-Jinja2-3.1.4-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "python311-Jinja2-3.1.4-1.1.x86_64",
"product": {
"name": "python311-Jinja2-3.1.4-1.1.x86_64",
"product_id": "python311-Jinja2-3.1.4-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "python312-Jinja2-3.1.4-1.1.x86_64",
"product": {
"name": "python312-Jinja2-3.1.4-1.1.x86_64",
"product_id": "python312-Jinja2-3.1.4-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python310-Jinja2-3.1.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64"
},
"product_reference": "python310-Jinja2-3.1.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python310-Jinja2-3.1.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le"
},
"product_reference": "python310-Jinja2-3.1.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python310-Jinja2-3.1.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x"
},
"product_reference": "python310-Jinja2-3.1.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python310-Jinja2-3.1.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64"
},
"product_reference": "python310-Jinja2-3.1.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-Jinja2-3.1.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64"
},
"product_reference": "python311-Jinja2-3.1.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-Jinja2-3.1.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le"
},
"product_reference": "python311-Jinja2-3.1.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-Jinja2-3.1.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x"
},
"product_reference": "python311-Jinja2-3.1.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-Jinja2-3.1.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64"
},
"product_reference": "python311-Jinja2-3.1.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python312-Jinja2-3.1.4-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64"
},
"product_reference": "python312-Jinja2-3.1.4-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python312-Jinja2-3.1.4-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le"
},
"product_reference": "python312-Jinja2-3.1.4-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python312-Jinja2-3.1.4-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x"
},
"product_reference": "python312-Jinja2-3.1.4-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python312-Jinja2-3.1.4-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
},
"product_reference": "python312-Jinja2-3.1.4-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2014-0012",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2014-0012"
}
],
"notes": [
{
"category": "general",
"text": "FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user\u0027s uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2014-0012",
"url": "https://www.suse.com/security/cve/CVE-2014-0012"
},
{
"category": "external",
"summary": "SUSE Bug 858239 for CVE-2014-0012",
"url": "https://bugzilla.suse.com/858239"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2014-0012"
},
{
"cve": "CVE-2016-10745",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-10745"
}
],
"notes": [
{
"category": "general",
"text": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-10745",
"url": "https://www.suse.com/security/cve/CVE-2016-10745"
},
{
"category": "external",
"summary": "SUSE Bug 1132174 for CVE-2016-10745",
"url": "https://bugzilla.suse.com/1132174"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2016-10745"
},
{
"cve": "CVE-2019-10906",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-10906"
}
],
"notes": [
{
"category": "general",
"text": "In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-10906",
"url": "https://www.suse.com/security/cve/CVE-2019-10906"
},
{
"category": "external",
"summary": "SUSE Bug 1132323 for CVE-2019-10906",
"url": "https://bugzilla.suse.com/1132323"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2019-10906"
},
{
"cve": "CVE-2020-28493",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-28493"
}
],
"notes": [
{
"category": "general",
"text": "This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-28493",
"url": "https://www.suse.com/security/cve/CVE-2020-28493"
},
{
"category": "external",
"summary": "SUSE Bug 1181944 for CVE-2020-28493",
"url": "https://bugzilla.suse.com/1181944"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-28493"
},
{
"cve": "CVE-2024-34064",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-34064"
}
],
"notes": [
{
"category": "general",
"text": "Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `\u003e`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-34064",
"url": "https://www.suse.com/security/cve/CVE-2024-34064"
},
{
"category": "external",
"summary": "SUSE Bug 1223980 for CVE-2024-34064",
"url": "https://bugzilla.suse.com/1223980"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python310-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python311-Jinja2-3.1.4-1.1.x86_64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.aarch64",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.ppc64le",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.s390x",
"openSUSE Tumbleweed:python312-Jinja2-3.1.4-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2024-34064"
}
]
}
PYSEC-2019-220
Vulnerability from pysec - Published: 2019-04-08 13:29 - Updated: 2021-11-22 04:57In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
| Name | purl | jinja2 | pkg:pypi/jinja2 |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "jinja2",
"purl": "pkg:pypi/jinja2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9b53045c34e61013dc8f09b7e52a555fa16bed16"
}
],
"repo": "https://github.com/pallets/jinja",
"type": "GIT"
},
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0",
"2.0rc1",
"2.1",
"2.1.1",
"2.2",
"2.2.1",
"2.3",
"2.3.1",
"2.4",
"2.4.1",
"2.5",
"2.5.1",
"2.5.2",
"2.5.3",
"2.5.4",
"2.5.5",
"2.6",
"2.7",
"2.7.1",
"2.7.2",
"2.7.3",
"2.8"
]
}
],
"aliases": [
"CVE-2016-10745",
"GHSA-hj2j-77xm-mc5v"
],
"details": "In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.",
"id": "PYSEC-2019-220",
"modified": "2021-11-22T04:57:52.929678Z",
"published": "2019-04-08T13:29:00Z",
"references": [
{
"type": "ARTICLE",
"url": "https://palletsprojects.com/blog/jinja-281-released/"
},
{
"type": "FIX",
"url": "https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2019:1022"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2019:1237"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2019:1260"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4011-1/"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/4011-2/"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2019:3964"
},
{
"type": "ADVISORY",
"url": "https://access.redhat.com/errata/RHSA-2019:4062"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-hj2j-77xm-mc5v"
}
]
}
RHSA-2019:1022
Vulnerability from csaf_redhat - Published: 2019-05-07 17:13 - Updated: 2025-11-21 18:08A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity as well as system integrity.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src | — |
Vendor Fix
fix
Workaround
|
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for python-jinja2 is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment. \n\nSecurity Fix(es):\n\n* python-jinja2: Sandbox escape due to information disclosure via str.format (CVE-2016-10745)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2019:1022",
"url": "https://access.redhat.com/errata/RHSA-2019:1022"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1698345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1698345"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1022.json"
}
],
"title": "Red Hat Security Advisory: python-jinja2 security update",
"tracking": {
"current_release_date": "2025-11-21T18:08:07+00:00",
"generator": {
"date": "2025-11-21T18:08:07+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2019:1022",
"initial_release_date": "2019-05-07T17:13:07+00:00",
"revision_history": [
{
"date": "2019-05-07T17:13:07+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2019-05-07T17:13:07+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T18:08:07+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.6.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::client"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.6.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::computenode"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.6.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
"product_id": "7Server-Alt-7.6.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::server"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.6.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:7::workstation"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "python-jinja2-0:2.7.2-3.el7_6.src",
"product": {
"name": "python-jinja2-0:2.7.2-3.el7_6.src",
"product_id": "python-jinja2-0:2.7.2-3.el7_6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-jinja2@2.7.2-3.el7_6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-jinja2-0:2.7.2-3.el7_6.noarch",
"product": {
"name": "python-jinja2-0:2.7.2-3.el7_6.noarch",
"product_id": "python-jinja2-0:2.7.2-3.el7_6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-jinja2@2.7.2-3.el7_6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-jinja2-0:2.7.2-3.el7_6.noarch as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch"
},
"product_reference": "python-jinja2-0:2.7.2-3.el7_6.noarch",
"relates_to_product_reference": "7Client-optional-7.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-jinja2-0:2.7.2-3.el7_6.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)",
"product_id": "7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src"
},
"product_reference": "python-jinja2-0:2.7.2-3.el7_6.src",
"relates_to_product_reference": "7Client-optional-7.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-jinja2-0:2.7.2-3.el7_6.noarch as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch"
},
"product_reference": "python-jinja2-0:2.7.2-3.el7_6.noarch",
"relates_to_product_reference": "7ComputeNode-optional-7.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-jinja2-0:2.7.2-3.el7_6.src as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7)",
"product_id": "7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src"
},
"product_reference": "python-jinja2-0:2.7.2-3.el7_6.src",
"relates_to_product_reference": "7ComputeNode-optional-7.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-jinja2-0:2.7.2-3.el7_6.noarch as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch"
},
"product_reference": "python-jinja2-0:2.7.2-3.el7_6.noarch",
"relates_to_product_reference": "7Server-7.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-jinja2-0:2.7.2-3.el7_6.src as a component of Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src"
},
"product_reference": "python-jinja2-0:2.7.2-3.el7_6.src",
"relates_to_product_reference": "7Server-7.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-jinja2-0:2.7.2-3.el7_6.noarch as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
"product_id": "7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch"
},
"product_reference": "python-jinja2-0:2.7.2-3.el7_6.noarch",
"relates_to_product_reference": "7Server-Alt-7.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-jinja2-0:2.7.2-3.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)",
"product_id": "7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src"
},
"product_reference": "python-jinja2-0:2.7.2-3.el7_6.src",
"relates_to_product_reference": "7Server-Alt-7.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-jinja2-0:2.7.2-3.el7_6.noarch as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch"
},
"product_reference": "python-jinja2-0:2.7.2-3.el7_6.noarch",
"relates_to_product_reference": "7Workstation-7.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-jinja2-0:2.7.2-3.el7_6.src as a component of Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src"
},
"product_reference": "python-jinja2-0:2.7.2-3.el7_6.src",
"relates_to_product_reference": "7Workstation-7.6.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-10745",
"cwe": {
"id": "CWE-138",
"name": "Improper Neutralization of Special Elements"
},
"discovery_date": "2019-04-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1698345"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python\u0027s string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity as well as system integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-jinja2: Sandbox escape due to information disclosure via str.format",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "* Red Hat OpenStack Platform is not affected by this flaw. All supported versions ship python-jinja2 packages which have already been fixed.\n* Red Hat Satellite 6 will receive fixes through the underlying Red Hat Enterprise Linux, so it will not issue updates to its own affected package.\n* Red Hat Update Infrastructure is not affected because its packaged versions of python-jinja2 do not use the Sandbox feature, nor does it allow untrusted jinja2 templates.\n* Red Hat Virtualization Management Appliance includes python-jinja2 as a dependency of ovirt-engine-backend, which only uses it with controlled format strings that are not exploitable.\n* Red Hat Ceph Storage 2 and 3 are affected by this flaw as it contains the vulnerable code and will get security fixes for python-jinja2 from Red Hat Enterprise Linux 7 channel.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-10745"
},
{
"category": "external",
"summary": "RHBZ#1698345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1698345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-10745",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-10745"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10745",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10745"
},
{
"category": "external",
"summary": "https://palletsprojects.com/blog/jinja-281-released/",
"url": "https://palletsprojects.com/blog/jinja-281-released/"
}
],
"release_date": "2016-12-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2019-05-07T17:13:07+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all applications using Jinja2 must be restarted.",
"product_ids": [
"7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2019:1022"
},
{
"category": "workaround",
"details": "If you don\u0027t want or you cannot upgrade Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow all `format` attributes on strings.",
"product_ids": [
"7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Client-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7ComputeNode-optional-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Server-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Server-Alt-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src",
"7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.noarch",
"7Workstation-7.6.Z:python-jinja2-0:2.7.2-3.el7_6.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-jinja2: Sandbox escape due to information disclosure via str.format"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.