An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template     Injection (SSTI) where it takes the source parameter as a template object, renders it, and then returns     it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple     third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates     without sandboxing (CVE-2019-8341)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for python-Jinja2 fixes the following issues :

Security issues fixed :

  - CVE-2016-10745: Fixed a sandbox escape caused by an     information disclosure via str.format (bsc#1132174).

  - CVE-2019-10906: Fixed a sandbox escape due to     information disclosure via str.format (bsc#1132323).

  - CVE-2019-8341: Fixed command injection in function     from_string (bsc#1125815).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for python-Jinja2 to version 2.10.1 fixes the following issues :

Security issues fixed :

  - CVE-2019-8341: Fixed a command injection in     from_string() (bsc#1125815).

  - CVE-2019-10906: Fixed a sandbox escape due to     information disclosure via str.format (bsc#1132323).

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Severity
250323	Linux Distros Unpatched Vulnerability : CVE-2019-8341	Nessus	Misc.	critical
126233	openSUSE Security Update : python-Jinja2 (openSUSE-2019-1614)	Nessus	SuSE Local Security Checks	critical
125022	openSUSE Security Update : python-Jinja2 (openSUSE-2019-1395)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-8341

critical

Tenable Plugins

critical

critical

critical