ELA-1396-1 jinja2 security update
ELA-1396-1 jinja2 security update
Package : jinja2
Version : 2.7.3-1+deb8u2 (jessie), 2.8-1+deb9u2 (stretch), 2.10-2+deb10u2 (buster)
Related CVEs :
CVE-2024-56326
CVE-2025-27516
A couple of vulnerabilities were found in jinja2, a template engine. The
rendering of untrusted templates could lead to attackers executing arbitrary
Python code.
CVE-2024-56326
Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects
calls to str.format allows an attacker that controls the content of a
template to execute arbitrary Python code. To exploit the vulnerability, an
attacker needs to control the content of a template. Whether that is the
case depends on the type of application using Jinja. This vulnerability
impacts users of applications which execute untrusted templates. Jinja's
sandbox does catch calls to str.format and ensures they don't escape the
sandbox. However, it's possible to store a reference to a malicious string's
format method, then pass that to a filter that calls it. No such filters are
built-in to Jinja, but could be present through custom filters in an
application. After the fix, such indirect calls are also handled by the
sandbox.
CVE-2025-27516
Prior to 3.1.6, an oversight in how the Jinja sandboxed environment
interacts with the |attr filter allows an attacker that controls the
content of a template to execute arbitrary Python code. To exploit the
vulnerability, an attacker needs to control the content of a template.
Whether that is the case depends on the type of application using Jinja.
This vulnerability impacts users of applications which execute untrusted
templates. Jinja's sandbox does catch calls to str.format and ensures they
don't escape the sandbox. However, it's possible to use the |attr filter to
get a reference to a string's plain format method, bypassing the sandbox.
After the fix, the |attr filter no longer bypasses the environment's
attribute lookup.ELA-1396-1 jinja2 security update
