Lucene search

SnykCVE-2020-28493

HistoryFeb 01, 2021 - 8:15 p.m.

CVE-2020-28493

2021-02-0120:15:12

CWE-400

snyk

web.nvd.nist.gov

250

cve

2020

28493

jinja2

package

redos

vulnerability

regex

markdown

user content

request timeouts

memory limits

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

5.7

Confidence

High

EPSS

0.002

Percentile

57.3%

JSON

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the _punctuation_re regex operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

Affected configurations

Nvd

Node

palletsprojectsjinjaRange<2.11.3

Node

fedoraprojectfedoraMatch33

CNA Affected

[
  {
    "product": "jinja2",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0.0.0",
        "versionType": "custom"
      },
      {
        "lessThan": "2.11.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]