CVE-2016-10745
HIGH8.6EPSS 1.0%Jinja2 sandbox escape vulnerability
發布日:2019/4/10修改日:2026/4/28
描述
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
受影響套件(3)
- Debian/jinja2from 0, < 2.9.4-1
- PyPI/jinja2from 0, < 2.8.1
- PyPI/jinja2from 0, < 9b53045c34e61013dc8f09b7e52a555fa16bed16 | from 0, < 2.8.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
| osv | CVSS 3.1 | HIGH8.6 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
參考連結(19)
- ADVISORYhttps://github.com/advisories/GHSA-hj2j-77xm-mc5v
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-10745
- ADVISORYhttps://palletsprojects.com/blog/jinja-281-released/
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2016-10745
- PATCHhttps://github.com/pallets/jinja
- WEBhttp://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html
- WEBhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html
- WEBhttps://access.redhat.com/errata/RHSA-2019:1022
- WEBhttps://access.redhat.com/errata/RHSA-2019:1237
- WEBhttps://access.redhat.com/errata/RHSA-2019:1260
- WEBhttps://access.redhat.com/errata/RHSA-2019:3964
- WEBhttps://access.redhat.com/errata/RHSA-2019:4062
- WEBhttps://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16
- WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/jinja2/PYSEC-2019-220.yaml
- WEBhttps://palletsprojects.com/blog/jinja-281-released
- WEBhttps://usn.ubuntu.com/4011-1
- WEBhttps://usn.ubuntu.com/4011-1/
- WEBhttps://usn.ubuntu.com/4011-2
- WEBhttps://usn.ubuntu.com/4011-2/