Summary
USN-4011-1 fixed several vulnerabilities in Jinja2. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
Olivier Dony discovered that Jinja incorrectly handled str.format. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2016-10745)
Brian Welch discovered that Jinja incorrectly handled str.format_map. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2019-10906)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | jinja2 | 2.7.2-2ubuntu0.1~esm1 |
Vulnerabilities 2
-
High 8.6
Jinja2 sandbox escape vulnerability
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
-
High 8.6
Jinja2 sandbox escape via string formatting
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.