CVE-2020-28493
published 2021-02-01CVE-2020-28493: This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
3.55%
88.0th percentile
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jinja2 | < jinja2 2.11.3-1 (bookworm) | jinja2 2.11.3-1 (bookworm) |
| fedoraproject | fedora | — | — |
| msrc | azl3_nodejs_20.14.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.14.0-8_on_azure_linux_3.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_python-jinja2_2.11.3-1_on_cbl_mariner_1.0 | — | — |
| palletsprojects | jinja | < 2.11.3 | 2.11.3 |
| pocoo | jinja2 | >= 0 < 2.11.3-1 | 2.11.3-1 |
| pocoo | jinja2 | >= 0 < 2.11.3-1 | 2.11.3-1 |
| pocoo | jinja2 | >= 0 < 2.11.3-1 | 2.11.3-1 |
| pocoo | jinja2 | >= 0 < 2.11.3-1 | 2.11.3-1 |
| pocoo | jinja2 | >= 0 < 2.11.3 | 2.11.3 |
| pocoo | jinja2 | >= 0 < 2.10.1-2ubuntu0.2 | 2.10.1-2ubuntu0.2 |
| pocoo | jinja2 | >= 0 < 3.0.3-1ubuntu0.1 | 3.0.3-1ubuntu0.1 |
| pocoo | jinja2 | >= 0 < 2.7.2-2ubuntu0.1~esm2 | 2.7.2-2ubuntu0.1~esm2 |
| pocoo | jinja2 | >= 0 < 2.8-1ubuntu0.1+esm2 | 2.8-1ubuntu0.1+esm2 |
| pocoo | jinja2 | >= 0 < 2.10-1ubuntu0.18.04.1+esm1 | 2.10-1ubuntu0.18.04.1+esm1 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_msrc5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Jinja2 vulnerabilities
vendor_ubuntu·2024-01-25·CVSS 5.3
CVE-2020-28493 [MEDIUM] Jinja2 vulnerabilities
Title: Jinja2 vulnerabilities
Summary: Several security issues were fixed in jinja2.
Yeting Li discovered that Jinja incorrectly handled certain regex.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS. (CVE-2020-28493)
It was discovered that Jinja incorrectly handled certain HTML passed with
xmlatter filter. An attacker could inject arbitrary HTML attributes
keys and values potentially leading to XSS. (CVE-2024-22195)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Jinja2 vulnerability
vendor_ubuntu·2022-10-26
CVE-2020-28493 Jinja2 vulnerability
Title: Jinja2 vulnerability
Summary: Jinja2 could be made to hang if it received specially crafted input.
Yeting Li discovered that Jinja2 incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
Regular Expression Denial of Service (ReDoS)
vendor_msrc·2021-02-09·CVSS 5.3
CVE-2020-28493 [MEDIUM] CWE-400 Regular Expression Denial of Service (ReDoS)
Regular Expression Denial of Service (ReDoS)
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
snyk: snyk
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.co
Red Hat
python-jinja2: ReDoS vulnerability in the urlize filter
vendor_redhat·2021-02-01·CVSS 5.3
CVE-2020-28493 [MEDIUM] CWE-1333 python-jinja2: ReDoS vulnerability in the urlize filter
python-jinja2: ReDoS vulnerability in the urlize filter
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
A flaw was found in python-jinja2. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
Statement: This flaw is out o
Debian
CVE-2020-28493: jinja2 - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerab...
vendor_debian·2020·CVSS 5.3
CVE-2020-28493 [MEDIUM] CVE-2020-28493: jinja2 - This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerab...
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
Scope: local
bookworm: resolved (fixed in 2.11.3-1)
bullseye: resolved (fixed in 2.11.3-1)
forky: resolved (fixed in 2.11.3-1)
sid: resolved (fixed in 2.11.3-1)
trixie: resolved (fixed in 2.11.3-1)
OSV
jinja2 vulnerabilities
osv·2024-01-25·CVSS 5.3
CVE-2020-28493 [MEDIUM] jinja2 vulnerabilities
jinja2 vulnerabilities
Yeting Li discovered that Jinja incorrectly handled certain regex.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS. (CVE-2020-28493)
It was discovered that Jinja incorrectly handled certain HTML passed with
xmlatter filter. An attacker could inject arbitrary HTML attributes
keys and values potentially leading to XSS. (CVE-2024-22195)
OSV
Regular Expression Denial of Service (ReDoS) in Jinja2
osv·2021-03-19
CVE-2020-28493 [MEDIUM] Regular Expression Denial of Service (ReDoS) in Jinja2
Regular Expression Denial of Service (ReDoS) in Jinja2
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
GHSA
Regular Expression Denial of Service (ReDoS) in Jinja2
ghsa·2021-03-19
CVE-2020-28493 [MEDIUM] CWE-400 Regular Expression Denial of Service (ReDoS) in Jinja2
Regular Expression Denial of Service (ReDoS) in Jinja2
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9._-]+.[a-zA-Z0-9._-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
OSV
CVE-2020-28493: This affects the package jinja2 from 0
osv·2021-02-01·CVSS 5.3
CVE-2020-28493 [MEDIUM] CVE-2020-28493: This affects the package jinja2 from 0
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20https://github.com/pallets/jinja/pull/1343https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/https://security.gentoo.org/glsa/202107-19https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20https://github.com/pallets/jinja/pull/1343https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/https://security.gentoo.org/glsa/202107-19https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994
2021-02-01
Published