Vulnerability in Palletsprojects Jinja
CVE-2019-10906
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.036 (89.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 89.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.036 · newest: 0.036 · change: 0.000
Affected products
- Palletsprojects Jinja
- Canonical Ubuntu Linux — versions 12.04, 14.04, 16.04
- Fedoraproject Fedora — versions 28, 29, 30
- openSUSE Leap — versions 15.0, 42.3
- Red Hat Software Collections — versions 1.0
Public proof-of-concept exploits
References
- palletsprojects.com/blog/jinja-2-10-1-released (Release Notes, Vendor Advisory)
- lists.apache.org/thread.html/46c055e173b52d599c648a98199972dbd6a89d2b4c4647b050… (mailing-list)
- lists.apache.org/thread.html/b2380d147b508bbcb90d2cad443c159e63e12555966ab4f320… (mailing-list)
- lists.apache.org/thread.html/f0c4a03418bcfe70c539c5dbaf99c04c98da13bfa1d3266f08… (mailing-list)
- lists.apache.org/thread.html/57673a78c4d5c870d3f21465c7e2946b9f8285c7c57e54c2ae… (mailing-list)
- lists.apache.org/thread.html/320441dccbd9a545320f5f07306d711d4bbd31ba43dc9eebcf… (mailing-list)
- lists.apache.org/thread.html/2b52b9c8b9d6366a4f1b407a8bde6af28d9fc73fdb3b37695f… (mailing-list)
- lists.apache.org/thread.html/7f39f01392d320dfb48e4901db68daeece62fd60ef20955966… (mailing-list)
- lists.apache.org/thread.html/09fc842ff444cd43d9d4c510756fec625ef8eb1175f14fd21d… (mailing-list)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2019-10906?
- CVE-2019-10906 is a high-severity vulnerability in Palletsprojects Jinja. CVSS score: 8.6/10. Published 2019-04-07.
- How severe is CVE-2019-10906?
- High severity. CVSS v3 base score is 8.6 out of 10.
- Is CVE-2019-10906 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.