51 matches found
Security Bulletin: Jinja Template Sandbox Escape via Indirect str.format Execution Prior to 3.1.5
Summary Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control...
jinja2: Jinja has a sandbox breakout through indirect reference to format method
A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...
jinja2: Jinja has a sandbox breakout through indirect reference to format method
A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to...
Arbitrary Code Execution
ASTEVAL is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper handling of FormattedValue AST nodes due to the use of Python's str.format method, allowing attackers to bypass restrictions and execute arbitrary code...
Arbitrary Code Execution
Jinja2 is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper detection in the sandboxed environment caused by an oversight in how calls to str.format are handled, allowing attackers to execute arbitrary Python code if they control the content of a template and exploit...
CVE-2024-56326
Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the...
CVE-2024-56326: Improper Neutralization of Special Elements Used in a Template Engine
Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the...
Plone Unauthorized Access Vulnerability
Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...
GHSA-QC57-H2F7-P4HX Plone Unauthorized Access Vulnerability
Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5...
Security update for python-Jinja2
This update for python-Jinja2 fixes the following issues: CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format bsc1132323. CVE-2019-8341: Fixed a command injection in function fromstring bsc1125815. Patch Instructions: To install this SUSE update use the SUSE...
Important: Red Hat Security Advisory: python-jinja2 security update
An update for python-jinja2 is now available for Red Hat Enterprise Linux 7.5 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...
Amazon Linux 2 : python-jinja2 (ALAS-2019-1223)
In Pallets Jinja, str.format allows a sandbox escape. CVE-2016-10745 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Amazon Linux 2 Security Advisory ALAS-2019-1223. include'compat.inc'; if description scriptid126831; scriptversion"1.3";...
Important: python-jinja2
Issue Overview: In Pallets Jinja, str.format allows a sandbox escape. CVE-2016-10745 Affected Packages: python-jinja2 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Ru...
Ubuntu 16.04 LTS / 18.04 LTS : Jinja2 vulnerabilities (USN-4011-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4011-1 advisory. Olivier Dony discovered that Jinja incorrectly handled str.format. An attacker could possibly use this issue to escape the sandbox. This issu...
USN-4011-1 jinja2 vulnerabilities
Olivier Dony discovered that Jinja incorrectly handled str.format. An attacker could possibly use this issue to escape the sandbox. This issue only affected Ubuntu 16.04 LTS. CVE-2016-10745 Brian Welch discovered that Jinja incorrectly handled str.formatmap. An attacker could possibly use this...
Updated python-jinja2 packages fix security vulnerability
Sandbox escape due to information disclosure via str.format CVE-2016-10745. str.formatmap allows sandbox escape CVE-2019-10906...
Important: Red Hat Security Advisory: python-jinja2 security update
An update for python-jinja2 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...
Jinja2 sandbox escape vulnerability
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape...
Sandbox Escape
Jinja2 is vulnerable to sandbox escapes. Users are allowed to input str.format through web templates, leading to an escape from sandbox. This CVE is related to CVE-2019-10906...