Medium ELSA-2024-4231 1 CVE

Moderate: python-jinja2 security update (Oracle Linux 8)

Published Jul 3, 2024 · Updated Jul 3, 2024

Ecosystem: Oracle Linux

Summary

[2.10.1-5]
- Security fix for CVE-2024-34064
Resolves: RHEL-35651

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 8	python3-jinja2	0:2.10.1-5.el8_10

Vulnerabilities 1

Medium 5.4

CVE-2024-34064 Public exploit

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…

pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI

May 6, 2024