The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:2612 advisory.

    Python is an interpreted, interactive, object-oriented programming language, which includes modules,     classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to     many system calls and libraries, as well as to various windowing systems.

    Security Fix(es):

    * jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0018 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-56326:
    Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed     environment detects calls to str.format allows an attacker that controls the content of a template to     execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a     template. Whether that is the case depends on the type of application using Jinja. This vulnerability     impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to     str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a     malicious string's format method, then pass that to a filter that calls it. No such filters are built-in     to Jinja, but could be present through custom filters in an application. After the fix, such indirect     calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-1250 advisory.

    [2.7.2-4.0.1]
    - Fix for CVE-2024-56326 [Orabug: 37576737]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:0308 advisory.

    * fence-agents: Jinja has a sandbox breakout through indirect reference to format method [almalinux-9.5.z]     (CVE-2024-56326)
      * fence-agents: Jinja has a sandbox breakout through malicious filenames [almalinux-9.5.z]     (CVE-2024-56201)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-0308 advisory.

    [4.10.0-76.4]
    - bundled jinja2: fix CVE-2024-56201 and CVE-2024-56326       Resolves: RHEL-72070, RHEL-72063

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7244-1 advisory.

    It was discovered that Jinja2 incorrectly handled certain filenames when compiling template content. An     attacker could possibly use this issue to execute arbitrary code. (CVE-2024-56201)

    It was discovered that Jinja2 incorrectly handled string formatting calls. An attacker could possibly use     this issue to execute arbitrary code. (CVE-2024-56326)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja     compiler allows an attacker that controls both the content and filename of a template to execute arbitrary     Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to     control both the filename and the contents of a template. Whether that is the case depends on the type of     application using Jinja. This vulnerability impacts users of applications which execute untrusted     templates where the template author can also choose the template filename. (CVE-2024-56201)

    Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed     environment detects calls to str.format allows an attacker that controls the content of a template to     execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a     template. Whether that is the case depends on the type of application using Jinja. This vulnerability     impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to     str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a     malicious string's format method, then pass that to a filter that calls it. No such filters are built-in     to Jinja, but could be present through custom filters in an application. After the fix, such indirect     calls are also handled by the sandbox. (CVE-2024-56326)

Tenable has extracted the preceding description block directly from the EulerOS python-jinja2 security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:0667 advisory.

    * jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:2399 advisory.

    Red Hat Satellite is a system management solution that allows organizations     to configure and maintain their systems without the necessity to provide     public Internet access to their servers or other client systems. It     performs provisioning and configuration management of predefined standard     operating environments.

    Security Fix(es):

    * python-jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326)

    * python-django: potential denial-of-service vulnerability in IPv6 validation (CVE-2024-56374)

    Users of Red Hat Satellite are advised to upgrade to these updated     packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
232812	RHEL 8 : python-jinja2 (RHSA-2025:2612)	Nessus	Red Hat Local Security Checks	3/15/2025	6/5/2025	medium
236290	Alibaba Cloud Linux 3 : 0018: python-jinja2 (ALINUX3-SA-2025:0018)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	medium
238032	Oracle Linux 7 : python-jinja2 (ELSA-2025-1250)	Nessus	Oracle Linux Local Security Checks	6/9/2025	6/9/2025	medium
214227	AlmaLinux 9 : fence-agents (ALSA-2025:0308)	Nessus	Alma Linux Local Security Checks	1/15/2025	1/15/2025	medium
214260	Oracle Linux 9 : fence-agents (ELSA-2025-0308)	Nessus	Oracle Linux Local Security Checks	1/16/2025	6/9/2025	medium
214801	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Jinja2 vulnerabilities (USN-7244-1)	Nessus	Ubuntu Local Security Checks	1/30/2025	1/30/2025	medium
233605	EulerOS 2.0 SP13 : python-jinja2 (EulerOS-SA-2025-1341)	Nessus	Huawei Local Security Checks	4/1/2025	4/1/2025	medium
214645	AlmaLinux 9 : python-jinja2 (ALSA-2025:0667)	Nessus	Alma Linux Local Security Checks	1/25/2025	1/25/2025	medium
232538	RHEL 8 / 9 : Satellite 6.16.3 Async Update (Moderate) (RHSA-2025:2399)	Nessus	Red Hat Local Security Checks	3/10/2025	6/5/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium