PyPI/jinja2 CVE-2016-10745: high 8.6, EPSS 3.52%

Jinja2 sandbox escape vulnerability

Action: Upgrade jinja2 to 2.8.1 or later.

pip install jinja2==2.8.1

Affected

Fixed versions

Sources

• osv: GHSA-hj2j-77xm-mc5v
• https://nvd.nist.gov/vuln/detail/CVE-2016-10745
• https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16
• https://access.redhat.com/errata/RHSA-2019:1022
• https://access.redhat.com/errata/RHSA-2019:1237
• https://access.redhat.com/errata/RHSA-2019:1260
• https://access.redhat.com/errata/RHSA-2019:3964
• https://access.redhat.com/errata/RHSA-2019:4062
• https://github.com/advisories/GHSA-hj2j-77xm-mc5v
• https://github.com/pallets/jinja
• https://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2019-220.yaml
• https://palletsprojects.com/blog/jinja-281-released
• https://usn.ubuntu.com/4011-1
• https://usn.ubuntu.com/4011-2
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html

CVE-2016-10745 · published 2019-04-10T14:30:13Z · modified 2024-09-24T21:04:16.963502Z · JSON