Lucene search

K
almalinuxAlmaLinuxALSA-2024:2348
HistoryApr 30, 2024 - 12:00 a.m.

Moderate: python-jinja2 security update

2024-04-3000:00:00
errata.almalinux.org
8
python-jinja2
security update
html attribute injection
cve-2024-22195
sandboxed environment
almalinux
release notes

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

40.9%

The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment.

Security Fix(es):

  • jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

OSVersionArchitecturePackageVersionFilename
almalinux9noarchpython3-jinja2< 2.11.3-5.el9python3-jinja2-2.11.3-5.el9.noarch.rpm