CVE-2019-10906 Jinja2 sandbox escape via string formatting
Attackers can execute arbitrary code by exploiting a sandbox escape in the Jinja templating engine's format_map function.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10906?
CVE-2019-10906 is a high-severity code injection vulnerability in Canonical Ubuntu Linux, published on 6 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Which versions are affected by CVE-2019-10906?
3 open source packages ship an affected version, including jinja2 and Jinja2. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
jinja2 PyPI | All versions | 2.10.1 |
jinja2 PyPI | All versions | 2.10.1 |
Jinja2 PyPI | All versions | 2.10.1 |
Linux distribution packages (5)
python-jinja2 Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.1-2.el8_0 |
python3-jinja2 Red Hat:enterprise_linux:8::appstream | All versions | 0:2.10.1-2.el8_0 |
rh-python36-python-jinja2 Red Hat:rhel_software_collections:3::el6 | All versions | 0:2.9.6-3.el6 |
rh-python36-python-jinja2 Red Hat:rhel_software_collections:3::el7 | All versions | 0:2.9.6-3.el7 |
python-jinja2 Rocky Linux:8 | All versions | 0:2.10.1-2.el8_0 |
Products include Canonical Ubuntu Linux, Fedoraproject Fedora, Opensuse Leap, Palletsprojects Jinja, Redhat Software Collections.
How do I fix CVE-2019-10906?
Upgrade jinja2 to 2.10.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-10906 being exploited?
There is no known exploitation of CVE-2019-10906 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as AZL-41949, DEBIAN-CVE-2019-10906, GHSA-462w-v97r-4m45, PYSEC-2019-217, RHSA-2019:1152, RHSA-2019:1329 and 2 more.