Moderate: python-jinja2 security update
Summary
ALSA-2024:2348: Moderate: python-jinja2 security update. Affects python3-jinja2 versions < 2.11.3-5.el9. Fixed in 2.11.3-5.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment.
Vulnerability Detail
The vulnerability (CVE-2024-22195) in python-jinja2 allows HTML attribute injection when passing user input as keys to the xmlattr filter. This can lead to potential security issues, such as cross-site scripting (XSS) attacks, where an attacker can inject malicious code into the HTML output.
How To Fix
Minimum fixed version
2.11.3-5.el9
This is the first release that contains the fix.
sudo dnf update python3-jinja2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating the python-jinja2 package to the latest version is the recommended solution.
Conclusion
In conclusion, the python-jinja2 package is vulnerable to HTML attribute injection when passing user input as keys to the xmlattr filter. To mitigate this vulnerability, it is crucial to update the package to version 2.11.3-5.el9 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for python3-jinja2 →
FAQ
Python-jinja2 is a template engine written in pure Python, providing a non-XML syntax inspired by Django.
The vulnerability allows HTML attribute injection, which can lead to potential security issues like cross-site scripting (XSS) attacks.
To fix this vulnerability, update the python-jinja2 package to version 2.11.3-5.el9 or later.
There is no specific workaround mentioned for this vulnerability. Updating the python-jinja2 package is the recommended solution.
You can find more information about this vulnerability in the CVE page(s) listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for python3-jinja2.
