USN-6599-1: Jinja2 vulnerabilities
24668
07 August 2024
15 July 2024
CLOSED
MEDIUM
CVE-2020-28493;CVE-2024-22195
Severity
medium
Vendor
VMware Tanzu
Versions Affected
- Canonical Ubuntu 16.04
- Operations Manager Image—2.10.x
Description
Yeting Li discovered that Jinja incorrectly handled certain regex. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-28493) It was discovered that Jinja incorrectly handled certain HTML passed with xmlatter filter. An attacker could inject arbitrary HTML attributes keys and values potentially leading to XSS. (CVE-2024-22195) Update Instructions: Run `sudo pro fix USN-6599-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: python-jinja2 - 2.8-1ubuntu0.1+esm2 python-jinja2-doc - 2.8-1ubuntu0.1+esm2 python3-jinja2 - 2.8-1ubuntu0.1+esm2 Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro.
Fixed VMware Products and Versions
- Operations Manager
- 3.0.24+LTS-T or greater
References
https://ubuntu.com/security/notices/USN-6599-1
https://www.cloudfoundry.org/blog/usn-6599-1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=usn-6599-1
History
2024-01-25: Initial vulnerability report published.