CVE-2016-10745 Jinja2 sandbox escape vulnerability
HighCVSS 8.6
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi jinja2(PyPI) | < 2.8.1 | 2.8.1 |
| pypi jinja2(PyPI) | = 2.0 | No fix listed |
| pypi jinja2(PyPI) | = 2.0rc1 | No fix listed |
| pypi jinja2(PyPI) | = 2.1 | No fix listed |
| pypi jinja2(PyPI) | = 2.1.1 | No fix listed |
| pypi jinja2(PyPI) | = 2.2 | No fix listed |
| pypi jinja2(PyPI) | = 2.2.1 | No fix listed |
| pypi jinja2(PyPI) | = 2.3 | No fix listed |
| pypi jinja2(PyPI) | = 2.3.1 | No fix listed |
| pypi jinja2(PyPI) | = 2.4 | No fix listed |
| pypi jinja2(PyPI) | = 2.4.1 | No fix listed |
| pypi jinja2(PyPI) | = 2.5 | No fix listed |
| pypi jinja2(PyPI) | = 2.5.1 | No fix listed |
| pypi jinja2(PyPI) | = 2.5.2 | No fix listed |
| pypi jinja2(PyPI) | = 2.5.3 | No fix listed |
| pypi jinja2(PyPI) | = 2.5.4 | No fix listed |
| pypi jinja2(PyPI) | = 2.5.5 | No fix listed |
| pypi jinja2(PyPI) | = 2.6 | No fix listed |
| pypi jinja2(PyPI) | = 2.7 | No fix listed |
| pypi jinja2(PyPI) | = 2.7.1 | No fix listed |
| pypi jinja2(PyPI) | = 2.7.2 | No fix listed |
| pypi jinja2(PyPI) | = 2.7.3 | No fix listed |
| pypi jinja2(PyPI) | = 2.8 | No fix listed |
| debian/jinja2(Debian:12) | < 2.9.4-1 | 2.9.4-1 |
| debian/jinja2(Debian:13) | < 2.9.4-1 | 2.9.4-1 |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/jinja2(Debian:14) | < 2.9.4-1 | 2.9.4-1 |
| palletsprojects jinja | < 2.8.1 | 2.8.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- RHSA-2019:1022 vendor-advisory
- RHSA-2019:1237 vendor-advisory
- RHSA-2019:1260 vendor-advisory
- RHSA-2019:3964 vendor-advisory
- RHSA-2019:4062 vendor-advisory
- github.com vendor-advisory
- github.com product
- github.com
- palletsprojects.com technical-description vendor-advisory
- USN-4011-1 vendor-advisory
- USN-4011-2 vendor-advisory
- openSUSE-SU-2019:1395 vendor-advisory
- openSUSE-SU-2019:1614 vendor-advisory
- Debian Security Tracker CVE-2016-10745 vendor-advisory