CVE-2020-28493

描述

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

如何修補 CVE-2020-28493

要修補 CVE-2020-28493,請將受影響套件升級到下列已修補版本。

• —升級至 1.11.3-r0 或更新版本
• —升級至 2.11.3-1 或更新版本
• —升級至 2.11.3 或更新版本
• —升級至 2.11.3 或更新版本

CVE-2020-28493 正在被利用嗎?

低 — EPSS 為 3.5%,目前沒有觀察到大規模利用活動。

受影響套件(4)

• from 0, < 1.11.3-r0
• from 0, < 2.11.3-1
• from 0, < 2.11.3
• from 0, < 2.11.3

CVSS 分數

參考連結(13)

• ADVISORYgithub.com/advisories/GHSA-g3rq-g295-4j3m
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-28493
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2020-28493
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2020-28493
• PATCH