CVE-2016-10745
published 2019-04-08CVE-2016-10745: In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
PriorityP342high8.6CVSS 3.0
AVNACLPRNUINSCCHINAN
EPSS
3.49%
87.9th percentile
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jinja2 | < jinja2 2.9.4-1 (bookworm) | jinja2 2.9.4-1 (bookworm) |
| palletsprojects | jinja | < 2.8.1 | 2.8.1 |
| pocoo | jinja2 | >= 0 < 2.9.4-1 | 2.9.4-1 |
| pocoo | jinja2 | >= 0 < 2.9.4-1 | 2.9.4-1 |
| pocoo | jinja2 | >= 0 < 2.9.4-1 | 2.9.4-1 |
| pocoo | jinja2 | >= 0 < 2.9.4-1 | 2.9.4-1 |
| pocoo | jinja2 | >= 0 < 2.8.1 | 2.8.1 |
| pocoo | jinja2 | >= 0 < 2.8-1ubuntu0.1 | 2.8-1ubuntu0.1 |
| pocoo | jinja2 | >= 0 < 2.10-1ubuntu0.18.04.1 | 2.10-1ubuntu0.18.04.1 |
| pocoo | jinja2 | >= 0 < 2.7.2-2ubuntu0.1~esm1 | 2.7.2-2ubuntu0.1~esm1 |
CVSS provenance
nvdv3.08.6HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv8.6HIGH
vendor_debian8.6HIGH
vendor_redhat8.6HIGH
vendor_ubuntu8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
jinja2 vulnerabilities
osv·2019-06-06·CVSS 8.6
CVE-2016-10745 [HIGH] jinja2 vulnerabilities
jinja2 vulnerabilities
USN-4011-1 fixed several vulnerabilities in Jinja2. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
Olivier Dony discovered that Jinja incorrectly handled str.format. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2016-10745)
Brian Welch discovered that Jinja incorrectly handled str.format_map. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2019-10906)
OSV
jinja2 vulnerabilities
osv·2019-06-06·CVSS 8.6
CVE-2016-10745 [HIGH] jinja2 vulnerabilities
jinja2 vulnerabilities
Olivier Dony discovered that Jinja incorrectly handled str.format. An
attacker could possibly use this issue to escape the sandbox. This issue
only affected Ubuntu 16.04 LTS. (CVE-2016-10745)
Brian Welch discovered that Jinja incorrectly handled str.format_map. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2019-10906)
OSV
Jinja2 sandbox escape vulnerability
osv·2019-04-10
CVE-2016-10745 [HIGH] Jinja2 sandbox escape vulnerability
Jinja2 sandbox escape vulnerability
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
GHSA
Jinja2 sandbox escape vulnerability
ghsa·2019-04-10
CVE-2016-10745 [HIGH] CWE-134 Jinja2 sandbox escape vulnerability
Jinja2 sandbox escape vulnerability
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
OSV
CVE-2016-10745: In Pallets Jinja before 2
osv·2019-04-08·CVSS 8.6
CVE-2016-10745 [HIGH] CVE-2016-10745: In Pallets Jinja before 2
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
Ubuntu
Jinja2 vulnerabilities
vendor_ubuntu·2019-06-06·CVSS 8.6
CVE-2016-10745 [HIGH] Jinja2 vulnerabilities
Title: Jinja2 vulnerabilities
Summary: Several security issues were fixed in Jinja2.
Olivier Dony discovered that Jinja incorrectly handled str.format. An
attacker could possibly use this issue to escape the sandbox. This issue
only affected Ubuntu 16.04 LTS. (CVE-2016-10745)
Brian Welch discovered that Jinja incorrectly handled str.format_map. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2019-10906)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Jinja2 vulnerabilities
vendor_ubuntu·2019-06-06·CVSS 8.6
CVE-2016-10745 [HIGH] Jinja2 vulnerabilities
Title: Jinja2 vulnerabilities
Summary: Several security issues were fixed in Jinja2.
USN-4011-1 fixed several vulnerabilities in Jinja2. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
Olivier Dony discovered that Jinja incorrectly handled str.format. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2016-10745)
Brian Welch discovered that Jinja incorrectly handled str.format_map. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2019-10906)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-jinja2: Sandbox escape due to information disclosure via str.format
vendor_redhat·2016-12-29·CVSS 8.6
CVE-2016-10745 [HIGH] CWE-138 python-jinja2: Sandbox escape due to information disclosure via str.format
python-jinja2: Sandbox escape due to information disclosure via str.format
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity as well as system integrity.
Statement: * Red Hat OpenStack Platform is not affected by this flaw. All supported versions ship python-jinja2 packages which have already been fixed.
* Red Hat Satellite 6 will receive fixes through the underlying Red Hat Enterprise Linux, so it will not issue updates to its own affected package.
* Red Hat Update Infrastructur
Debian
CVE-2016-10745: jinja2 - In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
vendor_debian·2016·CVSS 8.6
CVE-2016-10745 [HIGH] CVE-2016-10745: jinja2 - In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
Scope: local
bookworm: resolved (fixed in 2.9.4-1)
bullseye: resolved (fixed in 2.9.4-1)
forky: resolved (fixed in 2.9.4-1)
sid: resolved (fixed in 2.9.4-1)
trixie: resolved (fixed in 2.9.4-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format [fedora-28]
bugzilla·2019-04-10·CVSS 8.6
CVE-2016-10745 [HIGH] CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format [fedora-28]
CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format [fedora-28]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-28.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the followin
Bugzilla
CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format [fedora-29]
bugzilla·2019-04-10·CVSS 8.6
CVE-2016-10745 [HIGH] CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format [fedora-29]
CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format [fedora-29]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-29.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the followin
Bugzilla
CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format
bugzilla·2019-04-10·CVSS 8.6
CVE-2016-10745 [HIGH] CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format
CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.
The core of the issue is that Python's string format method that was added to strings can be used to discover potentially dangerous values including configuration values.
References:
https://nvd.nist.gov/vuln/detail/CVE-2016-10745
https://palletsprojects.com/blog/jinja-281-released/
https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16
Discussion:
Created python-jinja2 tracking bugs for this issue:
Affects: epel-6 [bug 1698346]
Affects: fedora-28 [bug 1698349]
Affects: fedora-29 [bug 1698350]
Created python3-jinja2 tracking bugs for this issue:
Affects: epel-6 [bug 1698347]
Affects: epel-7 [bug 16983
Bugzilla
CVE-2016-10745 python3-jinja2: python-jinja2: Sandbox escape due to information disclosure via str.format [epel-6]
bugzilla·2019-04-10·CVSS 8.6
CVE-2016-10745 [HIGH] CVE-2016-10745 python3-jinja2: python-jinja2: Sandbox escape due to information disclosure via str.format [epel-6]
CVE-2016-10745 python3-jinja2: python-jinja2: Sandbox escape due to information disclosure via str.format [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use th
Bugzilla
CVE-2016-10745 python-jinja2-26: python-jinja2: Sandbox escape due to information disclosure via str.format [epel-6]
bugzilla·2019-04-10·CVSS 8.6
CVE-2016-10745 [HIGH] CVE-2016-10745 python-jinja2-26: python-jinja2: Sandbox escape due to information disclosure via str.format [epel-6]
CVE-2016-10745 python-jinja2-26: python-jinja2: Sandbox escape due to information disclosure via str.format [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use
Bugzilla
CVE-2016-10745 python3-jinja2: python-jinja2: Sandbox escape due to information disclosure via str.format [epel-7]
bugzilla·2019-04-10·CVSS 8.6
CVE-2016-10745 [HIGH] CVE-2016-10745 python3-jinja2: python-jinja2: Sandbox escape due to information disclosure via str.format [epel-7]
CVE-2016-10745 python3-jinja2: python-jinja2: Sandbox escape due to information disclosure via str.format [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use th
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.htmlhttps://access.redhat.com/errata/RHSA-2019:1022https://access.redhat.com/errata/RHSA-2019:1237https://access.redhat.com/errata/RHSA-2019:1260https://access.redhat.com/errata/RHSA-2019:3964https://access.redhat.com/errata/RHSA-2019:4062https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16https://palletsprojects.com/blog/jinja-281-released/https://usn.ubuntu.com/4011-1/https://usn.ubuntu.com/4011-2/http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.htmlhttps://access.redhat.com/errata/RHSA-2019:1022https://access.redhat.com/errata/RHSA-2019:1237https://access.redhat.com/errata/RHSA-2019:1260https://access.redhat.com/errata/RHSA-2019:3964https://access.redhat.com/errata/RHSA-2019:4062https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16https://palletsprojects.com/blog/jinja-281-released/https://usn.ubuntu.com/4011-1/https://usn.ubuntu.com/4011-2/
2019-04-08
Published