Summary
Yeting Li discovered that Jinja incorrectly handled certain regex.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS. (CVE-2020-28493)
It was discovered that Jinja incorrectly handled certain HTML passed with
xmlatter filter. An attacker could inject arbitrary HTML attributes
keys and values potentially leading to XSS. (CVE-2024-22195)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | jinja2 | 2.10.1-2ubuntu0.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | jinja2 | 3.0.3-1ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | jinja2 | 2.7.2-2ubuntu0.1~esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | jinja2 | 2.8-1ubuntu0.1+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | jinja2 | 2.10-1ubuntu0.18.04.1+esm1 |
Vulnerabilities 2
-
Medium 5.4
Jinja vulnerable to Cross-Site Scripting (XSS)
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). …
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. T…