CVE-2019-10906
published 2019-04-07CVE-2019-10906: In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
PriorityP346high8.6CVSS 3.1
AVNACLPRNUINSCCHINAN
EPSS
3.60%
88.2th percentile
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | jinja2 | < jinja2 2.10-2 (bookworm) | jinja2 2.10-2 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | azl3_nodejs_20.14.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.14.0-8_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| palletsprojects | jinja | < 2.10.1 | 2.10.1 |
| pocoo | jinja2 | >= 0 < 2.10-2 | 2.10-2 |
| pocoo | jinja2 | >= 0 < 2.10-2 | 2.10-2 |
| pocoo | jinja2 | >= 0 < 2.10-2 | 2.10-2 |
| pocoo | jinja2 | >= 0 < 2.10-2 | 2.10-2 |
| pocoo | jinja2 | >= 0 < 2.10.1 | 2.10.1 |
| pocoo | jinja2 | >= 0 < 2.8-1ubuntu0.1 | 2.8-1ubuntu0.1 |
| pocoo | jinja2 | >= 0 < 2.10-1ubuntu0.18.04.1 | 2.10-1ubuntu0.18.04.1 |
| pocoo | jinja2 | >= 0 < 2.7.2-2ubuntu0.1~esm1 | 2.7.2-2ubuntu0.1~esm1 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv8.6HIGH
vendor_debian8.6HIGH
vendor_msrc8.6HIGH
vendor_redhat8.6HIGH
vendor_ubuntu8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
jinja2 vulnerabilities
osv·2019-06-06·CVSS 8.6
CVE-2016-10745 [HIGH] jinja2 vulnerabilities
jinja2 vulnerabilities
USN-4011-1 fixed several vulnerabilities in Jinja2. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
Olivier Dony discovered that Jinja incorrectly handled str.format. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2016-10745)
Brian Welch discovered that Jinja incorrectly handled str.format_map. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2019-10906)
OSV
jinja2 vulnerabilities
osv·2019-06-06·CVSS 8.6
CVE-2016-10745 [HIGH] jinja2 vulnerabilities
jinja2 vulnerabilities
Olivier Dony discovered that Jinja incorrectly handled str.format. An
attacker could possibly use this issue to escape the sandbox. This issue
only affected Ubuntu 16.04 LTS. (CVE-2016-10745)
Brian Welch discovered that Jinja incorrectly handled str.format_map. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2019-10906)
OSV
Jinja2 sandbox escape via string formatting
osv·2019-04-10
CVE-2019-10906 [HIGH] Jinja2 sandbox escape via string formatting
Jinja2 sandbox escape via string formatting
In Pallets Jinja before 2.10.1, `str.format_map` allows a sandbox escape.
The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox.
This issue was previously addressed for the `str.format` method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods.
If you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
GHSA
Jinja2 sandbox escape via string formatting
ghsa·2019-04-10
CVE-2019-10906 [HIGH] CWE-693 Jinja2 sandbox escape via string formatting
Jinja2 sandbox escape via string formatting
In Pallets Jinja before 2.10.1, `str.format_map` allows a sandbox escape.
The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the `str.format_map` method could be used to escape the sandbox.
This issue was previously addressed for the `str.format` method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common `str.format_map` method was overlooked. This release applies the same sandboxing to both methods.
If you cannot upgrade Jinja, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow the `format_map` method on string objects.
OSV
CVE-2019-10906: In Pallets Jinja before 2
osv·2019-04-07·CVSS 8.6
CVE-2019-10906 [HIGH] CVE-2019-10906: In Pallets Jinja before 2
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Ubuntu
Jinja2 vulnerabilities
vendor_ubuntu·2019-06-06·CVSS 8.6
CVE-2016-10745 [HIGH] Jinja2 vulnerabilities
Title: Jinja2 vulnerabilities
Summary: Several security issues were fixed in Jinja2.
Olivier Dony discovered that Jinja incorrectly handled str.format. An
attacker could possibly use this issue to escape the sandbox. This issue
only affected Ubuntu 16.04 LTS. (CVE-2016-10745)
Brian Welch discovered that Jinja incorrectly handled str.format_map. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2019-10906)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Jinja2 vulnerabilities
vendor_ubuntu·2019-06-06·CVSS 8.6
CVE-2016-10745 [HIGH] Jinja2 vulnerabilities
Title: Jinja2 vulnerabilities
Summary: Several security issues were fixed in Jinja2.
USN-4011-1 fixed several vulnerabilities in Jinja2. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
Olivier Dony discovered that Jinja incorrectly handled str.format. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2016-10745)
Brian Welch discovered that Jinja incorrectly handled str.format_map. An
attacker could possibly use this issue to escape the sandbox.
(CVE-2019-10906)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
In Pallets Jinja before 2.10.1 str.format_map allows a sandbox escape.
vendor_msrc·2019-04-09·CVSS 8.6
CVE-2019-10906 [HIGH] In Pallets Jinja before 2.10.1 str.format_map allows a sandbox escape.
In Pallets Jinja before 2.10.1 str.format_map allows a sandbox escape.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
mitre: mitre
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference
Red Hat
python-jinja2: str.format_map allows sandbox escape
vendor_redhat·2019-04-06·CVSS 8.6
CVE-2019-10906 [HIGH] CWE-138 python-jinja2: str.format_map allows sandbox escape
python-jinja2: str.format_map allows sandbox escape
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
A flaw was found in Jinja. Python string formatting could allow an attacker to escape the sandbox. The highest threat from this vulnerability is to data confidentiality and integrity and system availability.
Statement: Red Hat Virtualization Management Appliance includes python-jinja2 as a dependency of ovirt-engine-backend, which only uses it with controlled format strings that are not exploitable.
Red Hat Satellite 6 will receive fixes through the underlying Red Hat Enterprise Linux, so it won't issue updates to its own affected package.
This issue does not affect versions of python-jinja2 as shipped with:
* Red Hat Enterprise Linux 6, and 7 as python2 does not s
Debian
CVE-2019-10906: jinja2 - In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
vendor_debian·2019·CVSS 8.6
CVE-2019-10906 [HIGH] CVE-2019-10906: jinja2 - In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Scope: local
bookworm: resolved (fixed in 2.10-2)
bullseye: resolved (fixed in 2.10-2)
forky: resolved (fixed in 2.10-2)
sid: resolved (fixed in 2.10-2)
trixie: resolved (fixed in 2.10-2)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-10906 python3-jinja2: python-jinja2: str.format_map allows sandbox escape [epel-7]
bugzilla·2019-04-11·CVSS 8.6
CVE-2019-10906 [HIGH] CVE-2019-10906 python3-jinja2: python-jinja2: str.format_map allows sandbox escape [epel-7]
CVE-2019-10906 python3-jinja2: python-jinja2: str.format_map allows sandbox escape [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template to
Bugzilla
CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape
bugzilla·2019-04-11·CVSS 8.6
CVE-2019-10906 [HIGH] CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape
CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Reference:
https://palletsprojects.com/blog/jinja-2-10-1-released/
Upstream commit:
https://github.com/pallets/jinja/commit/a2a6c930bcca591a25d2b316fcfd2d6793897b26
Discussion:
Created python-jinja2 tracking bugs for this issue:
Affects: epel-6 [bug 1698840]
---
Created python-jinja2 tracking bugs for this issue:
Affects: fedora-all [bug 1699111]
Created python3-jinja2 tracking bugs for this issue:
Affects: epel-6 [bug 1699113]
Affects: epel-7 [bug 1699114]
---
External References:
https://palletsprojects.com/blog/jinja-2-10-1-released/
---
Mitigation:
If you cannot upgrade python-Jinja2, you can override the `is_safe_attribute` method
Bugzilla
CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape [openstack-rdo]
bugzilla·2019-04-11·CVSS 8.6
CVE-2019-10906 [HIGH] CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape [openstack-rdo]
CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape [openstack-rdo]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of openstack-rdo.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Updating python-jinja2 for Cent
Bugzilla
CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape [fedora-all]
bugzilla·2019-04-11·CVSS 8.6
CVE-2019-10906 [HIGH] CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape [fedora-all]
CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versio
Bugzilla
CVE-2019-10906 python-jinja2-26: python-jinja2: str.format_map allows sandbox escape [epel-6]
bugzilla·2019-04-11·CVSS 8.6
CVE-2019-10906 [HIGH] CVE-2019-10906 python-jinja2-26: python-jinja2: str.format_map allows sandbox escape [epel-6]
CVE-2019-10906 python-jinja2-26: python-jinja2: str.format_map allows sandbox escape [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template
Bugzilla
CVE-2019-10906 python3-jinja2: python-jinja2: str.format_map allows sandbox escape [epel-6]
bugzilla·2019-04-11·CVSS 8.6
CVE-2019-10906 [HIGH] CVE-2019-10906 python3-jinja2: python-jinja2: str.format_map allows sandbox escape [epel-6]
CVE-2019-10906 python3-jinja2: python-jinja2: str.format_map allows sandbox escape [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-6.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template to
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.htmlhttps://access.redhat.com/errata/RHSA-2019:1152https://access.redhat.com/errata/RHSA-2019:1237https://access.redhat.com/errata/RHSA-2019:1329https://lists.apache.org/thread.html/09fc842ff444cd43d9d4c510756fec625ef8eb1175f14fd21de2605f%40%3Cdevnull.infra.apache.org%3Ehttps://lists.apache.org/thread.html/2b52b9c8b9d6366a4f1b407a8bde6af28d9fc73fdb3b37695fd0d9ac%40%3Cdevnull.infra.apache.org%3Ehttps://lists.apache.org/thread.html/320441dccbd9a545320f5f07306d711d4bbd31ba43dc9eebcfc602df%40%3Cdevnull.infra.apache.org%3Ehttps://lists.apache.org/thread.html/46c055e173b52d599c648a98199972dbd6a89d2b4c4647b0500f2284%40%3Cdevnull.infra.apache.org%3Ehttps://lists.apache.org/thread.html/57673a78c4d5c870d3f21465c7e2946b9f8285c7c57e54c2ae552f02%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/7f39f01392d320dfb48e4901db68daeece62fd60ef20955966739993%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/b2380d147b508bbcb90d2cad443c159e63e12555966ab4f320ee22da%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/f0c4a03418bcfe70c539c5dbaf99c04c98da13bfa1d3266f08564316%40%3Ccommits.airflow.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSW3QZMFVVR7YE3UT4YRQA272TYAL5AF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCDYIS254EJMBNWOG4S5QY6AOTOR4TZU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS7IVZAJBWOHNRDMFJDIZVFCMRP6YIUQ/https://palletsprojects.com/blog/jinja-2-10-1-releasedhttps://usn.ubuntu.com/4011-1/https://usn.ubuntu.com/4011-2/http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.htmlhttps://access.redhat.com/errata/RHSA-2019:1152https://access.redhat.com/errata/RHSA-2019:1237https://access.redhat.com/errata/RHSA-2019:1329https://lists.apache.org/thread.html/09fc842ff444cd43d9d4c510756fec625ef8eb1175f14fd21de2605f%40%3Cdevnull.infra.apache.org%3Ehttps://lists.apache.org/thread.html/2b52b9c8b9d6366a4f1b407a8bde6af28d9fc73fdb3b37695fd0d9ac%40%3Cdevnull.infra.apache.org%3Ehttps://lists.apache.org/thread.html/320441dccbd9a545320f5f07306d711d4bbd31ba43dc9eebcfc602df%40%3Cdevnull.infra.apache.org%3Ehttps://lists.apache.org/thread.html/46c055e173b52d599c648a98199972dbd6a89d2b4c4647b0500f2284%40%3Cdevnull.infra.apache.org%3Ehttps://lists.apache.org/thread.html/57673a78c4d5c870d3f21465c7e2946b9f8285c7c57e54c2ae552f02%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/7f39f01392d320dfb48e4901db68daeece62fd60ef20955966739993%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/b2380d147b508bbcb90d2cad443c159e63e12555966ab4f320ee22da%40%3Ccommits.airflow.apache.org%3Ehttps://lists.apache.org/thread.html/f0c4a03418bcfe70c539c5dbaf99c04c98da13bfa1d3266f08564316%40%3Ccommits.airflow.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSW3QZMFVVR7YE3UT4YRQA272TYAL5AF/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCDYIS254EJMBNWOG4S5QY6AOTOR4TZU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TS7IVZAJBWOHNRDMFJDIZVFCMRP6YIUQ/https://palletsprojects.com/blog/jinja-2-10-1-releasedhttps://usn.ubuntu.com/4011-1/https://usn.ubuntu.com/4011-2/
2019-04-07
Published