tocsin

PyPI/jinja2 CVE-2020-28493: unknown, EPSS 3.55%

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the

Action: Upgrade jinja2 to 2.11.3 or later.

pip install jinja2==2.11.3

Affected

introducedfixedlast affected
02.11.3-

Fixed versions

2.11.3

Sources

CVE-2020-28493 · published · modified · JSON