Summary
Olivier Dony discovered that Jinja incorrectly handled str.format. An
attacker could possibly use this issue to escape the sandbox. This issue
only affected Ubuntu 16.04 LTS. (CVE-2016-10745)
Brian Welch discovered that Jinja incorrectly handled str.format_map. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2019-10906)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | jinja2 | 2.8-1ubuntu0.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | jinja2 | 2.10-1ubuntu0.18.04.1 |
Vulnerabilities 2
-
High 8.6
Jinja2 sandbox escape vulnerability
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
-
High 8.6
Jinja2 sandbox escape via string formatting
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.