Bug 1698345 (CVE-2016-10745)
| Summary: | CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Marian Rehak <mrehak> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | apevec, bbuckingham, bcourt, bkearney, bmcclain, btotty, cstratak, dbecker, dblechte, dfediuck, eedri, extras-orphan, hhorak, hhudgeon, jjoyce, jorton, jschluet, kbasil, lewk, lhh, lpeer, mburns, mgoldboi, michal.skrivanek, mmccune, orion, pj.pandit, python-maint, rchan, rhos-maint, rjerrido, rschiron, sbonazzo, sclewis, sherold, sisharma, slinaber, ssaha, thomas.moschny, TicoTimo, vbellur, yturgema |
| Target Milestone: | --- | Keywords: | Reopened, Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | python-jinja2 2.8.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity as well as system integrity.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-10 10:53:50 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1698346, 1698347, 1698348, 1698349, 1698350, 1701043, 1701044, 1701047, 1701048, 1701126, 1701127, 1701179, 1701308, 1701309, 1701310, 1701311, 1701312, 1701313, 1744473, 1744474 | ||
| Bug Blocks: | 1698351 | ||
|
Description
Marian Rehak
2019-04-10 07:54:36 UTC
Created python-jinja2 tracking bugs for this issue: Affects: epel-6 [bug 1698346] Affects: fedora-28 [bug 1698349] Affects: fedora-29 [bug 1698350] Created python3-jinja2 tracking bugs for this issue: Affects: epel-6 [bug 1698347] Affects: epel-7 [bug 1698348] External References: https://palletsprojects.com/blog/jinja-281-released/ Mitigation: If you don't want or you cannot upgrade Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow all `format` attributes on strings. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:1022 https://access.redhat.com/errata/RHSA-2019:1022 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:1237 https://access.redhat.com/errata/RHSA-2019:1237 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:1260 https://access.redhat.com/errata/RHSA-2019:1260 Red Hat Ceph Storage 2 and 3 will get the security fixes for python-jinja2 from RHEL7, hence changing state from affected:fix to affected:wontfix for Ceph. Statement: * Red Hat OpenStack Platform is not affected by this flaw. All supported versions ship python-jinja2 packages which have already been fixed. * Red Hat Satellite 6 will receive fixes through the underlying Red Hat Enterprise Linux, so it will not issue updates to its own affected package. * Red Hat Update Infrastructure is not affected because its packaged versions of python-jinja2 do not use the Sandbox feature, nor does it allow untrusted jinja2 templates. * Red Hat Virtualization Management Appliance includes python-jinja2 as a dependency of ovirt-engine-backend, which only uses it with controlled format strings that are not exploitable. * Red Hat Ceph Storage 2 and 3 are affected by this flaw as it contains the vulnerable code and will get security fixes for python-jinja2 from Red Hat Enterprise Linux 7 channel. This issue has been addressed in the following products: Red Hat Enterprise Linux 7.5 Extended Update Support Via RHSA-2019:3964 https://access.redhat.com/errata/RHSA-2019:3964 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions Red Hat Enterprise Linux 7.4 Telco Extended Update Support Via RHSA-2019:4062 https://access.redhat.com/errata/RHSA-2019:4062 |