{"action":"Upgrade jinja2 to 2.11.3 or later.","affected":[{"fixed":"2.11.3","introduced":"0"}],"component":"jinja2","cve_ids":["CVE-2020-28493"],"ecosystem":"PyPI","epss":0.03546,"exploited":false,"fixed_versions":["2.11.3"],"ghsa_id":"GHSA-g3rq-g295-4j3m","id":"tcs_01M5KGEFC6553JTT8FE8E3D9VR","modified_at":"2023-11-08T04:03:28.543308Z","published_at":"2021-02-01T20:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-66","https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20","https://github.com/pallets/jinja/pull/1343","https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/","https://github.com/advisories/GHSA-g3rq-g295-4j3m"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-66","url":"https://osv.dev/vulnerability/PYSEC-2021-66"}],"summary":"This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the"}