CVE-2020-28493Uncontrolled Resource Consumption in Jinja2

Severity
5.3MEDIUMNVD
EPSS
0.2%
top 56.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedFeb 1
Latest updateJan 25

Description

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

CVEListV5pocoo/jinja20.0.0unspecified+1
PyPIpocoo/jinja2< 2.11.3
Debianpocoo/jinja2< 2.11.3-1+3
Ubuntupocoo/jinja2< 2.10.1-2ubuntu0.2+4
NVDpalletsprojects/jinja< 2.11.3

Also affects: Fedora 33

Patches

🔴Vulnerability Details

5
OSV
jinja2 vulnerabilities2024-01-25
OSV
Regular Expression Denial of Service (ReDoS) in Jinja22021-03-19
GHSA
Regular Expression Denial of Service (ReDoS) in Jinja22021-03-19
CVEList
Regular Expression Denial of Service (ReDoS)2021-02-01
OSV
CVE-2020-28493: This affects the package jinja2 from 02021-02-01

📋Vendor Advisories

5
Ubuntu
Jinja2 vulnerabilities2024-01-25
Ubuntu
Jinja2 vulnerability2022-10-26
Microsoft
Regular Expression Denial of Service (ReDoS)2021-02-09
Red Hat
python-jinja2: ReDoS vulnerability in the urlize filter2021-02-01
Debian
CVE-2020-28493: jinja2 - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerab...2020
CVE-2020-28493 — Uncontrolled Resource Consumption | cvebase