The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-4231 advisory.

    [2.10.1-5]
    - Security fix for CVE-2024-34064     Resolves: RHEL-35651

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4404 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * jinja2: accepts keys containing non-attribute characters (CVE-2024-34064)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys     containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, ``, or `=`, as     each would then be interpreted as starting a separate attribute. If an application accepts keys (as     opposed to only values) as user input, and renders these in pages that other users see as well, an     attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only     addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an     unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input     should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to     be safe. This vulnerability is fixed in 3.1.4.(CVE-2024-34064)

Tenable has extracted the preceding description block directly from the EulerOS python-jinja2 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5810 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.64. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:5808

    Security Fix(es):

    * python-werkzeug: user may execute code on a developer's machine     (CVE-2024-34069)
    * golang: net/http: memory exhaustion in Request.ParseMultipartForm     (CVE-2023-45290)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:9150 advisory.

    The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a     Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment.

    Security Fix(es):

    * jinja2: accepts keys containing non-attribute characters (CVE-2024-34064)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of nodejs / nodejs18 / python-jinja2 installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-34064 advisory.

  - Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys     containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each     would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to     only values) as user input, and renders these in pages that other users see as well, an attacker could use     this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not     other characters. Accepting keys as user input is now explicitly considered an unintended use case of the     `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as     insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This     vulnerability is fixed in 3.1.4. (CVE-2024-34064)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2024:9150 advisory.

    * jinja2: accepts keys containing non-attribute characters (CVE-2024-34064)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
201553	Oracle Linux 8 : python-jinja2 (ELSA-2024-4231)	Nessus	Oracle Linux Local Security Checks	7/3/2024	11/2/2024	medium
202013	RHEL 8 : fence-agents update (Moderate) (RHSA-2024:4404)	Nessus	Red Hat Local Security Checks	7/9/2024	11/7/2024	medium
202409	EulerOS 2.0 SP10 : python-jinja2 (EulerOS-SA-2024-1919)	Nessus	Huawei Local Security Checks	7/15/2024	7/15/2024	medium
206302	RHEL 8 / 9 : OpenShift Container Platform 4.12.64 (RHSA-2024:5810)	Nessus	Red Hat Local Security Checks	8/29/2024	11/8/2024	high
210840	RHEL 9 : python-jinja2 (RHSA-2024:9150)	Nessus	Red Hat Local Security Checks	11/12/2024	3/6/2025	medium
215558	Azure Linux 3.0 Security Update: nodejs / nodejs18 / python-jinja2 (CVE-2024-34064)	Nessus	Azure Linux Local Security Checks	2/10/2025	4/20/2025	medium
232908	RockyLinux 9 : python-jinja2 (RLSA-2024:9150)	Nessus	Rocky Linux Local Security Checks	3/19/2025	3/19/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

high

medium

medium

medium