Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:3096-1

Опубликовано: 29 окт. 2020
Источник: suse-cvrf

Описание

Security update for python-Jinja2

This update for python-Jinja2 fixes the following issues:

  • CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format (bsc#1132323).
  • CVE-2019-8341: Fixed a command injection in function from_string (bsc#1125815).

Список пакетов

SUSE Linux Enterprise Module for Advanced Systems Management 12
python-Jinja2-2.8-19.20.1
python3-Jinja2-2.8-19.20.1
SUSE Linux Enterprise Module for Public Cloud 12
python-Jinja2-2.8-19.20.1
python3-Jinja2-2.8-19.20.1
SUSE Manager Client Tools 12
python-Jinja2-2.8-19.20.1
python3-Jinja2-2.8-19.20.1

Ссылки

Описание

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

Затронутые продукты
SUSE Linux Enterprise Module for Advanced Systems Management 12:python-Jinja2-2.8-19.20.1
SUSE Linux Enterprise Module for Advanced Systems Management 12:python3-Jinja2-2.8-19.20.1
SUSE Linux Enterprise Module for Public Cloud 12:python-Jinja2-2.8-19.20.1
SUSE Linux Enterprise Module for Public Cloud 12:python3-Jinja2-2.8-19.20.1
Ссылки

Описание

** DISPUTED ** An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing.

Затронутые продукты
SUSE Linux Enterprise Module for Advanced Systems Management 12:python-Jinja2-2.8-19.20.1
SUSE Linux Enterprise Module for Advanced Systems Management 12:python3-Jinja2-2.8-19.20.1
SUSE Linux Enterprise Module for Public Cloud 12:python-Jinja2-2.8-19.20.1
SUSE Linux Enterprise Module for Public Cloud 12:python3-Jinja2-2.8-19.20.1
Ссылки
Уязвимость SUSE-SU-2020:3096-1