Medium ELSA-2024-9150 1 CVE

Moderate: python-jinja2 security update (Oracle Linux 9)

Published Nov 14, 2024 · Updated Nov 14, 2024

Ecosystem: Oracle Linux

Summary

[2.11.3-6]
- Security fix for CVE-2024-34064
Resolves: RHEL-35653

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 9	python3-jinja2	0:2.11.3-6.el9

Vulnerabilities 1

Medium 5.4

CVE-2024-34064 Public exploit

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted as starting a separat…

pallets jinja nodejs kubeflow-pipelines-visualization-server Debian Ubuntu Azure Linux Alpine Wolfi PyPI

May 6, 2024