The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys     containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each     would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to     only values) as user input, and renders these in pages that other users see as well, an attacker could use     this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not     other characters. Accepting keys as user input is now explicitly considered an unintended use case of the     `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as     insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This     vulnerability is fixed in 3.1.4. (CVE-2024-34064)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2024-34064

medium Nessus Plugin ID 227465

Version 1.3