CVE-2019-10906

mediumPriorität · verfolgen · 35EPSS 0.035 · 89. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

3.53% (89th) EPSS

CVSS 5 · medium

Is it mine?

49 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · bewertet 2026-10-27

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenpython-jinja2-0:2.10.1-2.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1152
Behobenpython3-jinja2-0:2.10.1-2.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1152
Behobenrh-python35-python-jinja2-0:2.8.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1237
Behobenrh-python36-python-jinja2-0:2.9.6-3.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Behobenrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all applications using Jinja2 must be restarted.
https://access.redhat.com/errata/RHSA-2019:1329
Workaroundpython-jinja2-0:2.10.1-2.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundpython3-jinja2-0:2.10.1-2.el8_0.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python35-python-jinja2-0:2.8.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
Workaroundrh-python36-python-jinja2-0:2.9.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)redhat_csaf
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 5–9

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 4

v3.08.6highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:Nsecondary · OSV

v3.09criticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · Red Hat Product Security US

v3.17.9highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-138USCWE-693US

betroffene Produkte (49)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Red Hat Enterprise Linux 8alle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:8
SUSE Linuxalle Versionencert_bundDEcpe:/o:suse:suse_linux:-
Ubuntu Linuxalle Versionencert_bundDEcpe:/o:canonical:ubuntu_linux:-
n/a n/a≤ n/aenisa_euvdEU
canonical ubuntu linux= 12.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 14.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 16.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 18.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 18.10nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
canonical ubuntu linux= 19.04nvdUScpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
fedoraproject fedora= 28nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 29nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
fedoraproject fedora= 30nvdUScpe:2.3:o:fedoraproject:fedora:*:*:*:*:*:*:*:*
opensuse leap= 15.0nvdUScpe:2.3:o:opensuse:leap:*:*:*:*:*:*:*:*
opensuse leap= 42.3nvdUScpe:2.3:o:opensuse:leap:*:*:*:*:*:*:*:*
palletsprojects jinja< 2.10.1nvdUScpe:2.3:a:palletsprojects:jinja:*:*:*:*:*:*:*:*
redhat software collections= 1.0nvdUScpe:2.3:a:redhat:software_collections:*:*:*:*:*:*:*:*
PyPI jinja2< 2.10.1osvUSpkg:pypi/jinja2
python-jinja2-0:2.10.1-2.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)alle Versionenfixedredhat_csafUS

20 von 49 angezeigt

Advisories (6)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2019:1152Red Hat Security Advisory: python-jinja2 security update2019-05-13csaf · redhat_csafUS
An update for python-jinja2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2019:1237Red Hat Security Advisory: rh-python35-python-jinja2 security update2019-05-16csaf · redhat_csafUS
An update for rh-python35-python-jinja2 is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2019:1329Red Hat Security Advisory: rh-python36-python-jinja2 security update2019-06-04csaf · redhat_csafUS
An update for rh-python36-python-jinja2 is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2024-1440Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2019-05-13csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-462w-v97r-4m45Jinja2 sandbox escape via string formatting2019-04-10ghsa · osvUS
In Pallets Jinja before 2.10.1, `str.format_map` allows a sandbox escape. The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox. This issue was previously addressed for the `str.format` method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods. If you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
PYSEC-2019-2172019-04-07vendor · osvUS
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd osv cert_bund nvd redhat_csaf NVD CVE.org MITRE

veröffentlicht 2019-04-07geändert 2026-06-17

Referenzen (71)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan