CVE-2019-8341 Code injection in n/a

What is CVE-2019-8341?

CVE-2019-8341 is a critical code injection vulnerability in Opensuse Leap, published on 15 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing

Weakness: CWE-94

Which versions are affected by CVE-2019-8341?

It affects 2 products.

Products include Opensuse Leap, Pocoo Jinja2.

How do I fix CVE-2019-8341?

Change a configuration setting.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-8341 being exploited?

There is no known exploitation of CVE-2019-8341 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in Opensuse Leap

• CVE-2015-4902 Oracle Java SE Integrity Check Exploited Medium 5.3
• CVE-2017-14804 package builds could use directory traversal to write outside of target area Critical 9.9
• CVE-2019-20787 Teeworlds before 0.7.4 has an integer overflow when computing a tilemap size. Critical 9.8
• CVE-2019-6438 Other in n/a Critical 9.8
• CVE-2017-18215 Memory corruption in n/a Critical 9.8

All Opensuse Leap vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-8341, GHSA-f6pv-j8mr-w6rr, UBUNTU-CVE-2019-8341.