Bug 1698345 (CVE-2016-10745)

Summary: CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: apevec, bbuckingham, bcourt, bkearney, bmcclain, btotty, cstratak, dbecker, dblechte, dfediuck, eedri, extras-orphan, hhorak, hhudgeon, jjoyce, jorton, jschluet, kbasil, lewk, lhh, lpeer, mburns, mgoldboi, michal.skrivanek, mmccune, orion, pj.pandit, python-maint, rchan, rhos-maint, rjerrido, rschiron, sbonazzo, sclewis, sherold, sisharma, slinaber, ssaha, thomas.moschny, TicoTimo, vbellur, yturgema
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: python-jinja2 2.8.1 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:53:50 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1698346, 1744473, 1744474, 1698347, 1698348, 1698349, 1698350, 1701043, 1701044, 1701047, 1701048, 1701126, 1701127, 1701179, 1701308, 1701309, 1701310, 1701311, 1701312, 1701313    
Bug Blocks: 1698351    

Description Marian Rehak 2019-04-10 07:54:36 UTC
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

The core of the issue is that Python's string format method that was added to strings can be used to discover potentially dangerous values including configuration values.

References:
https://nvd.nist.gov/vuln/detail/CVE-2016-10745
https://palletsprojects.com/blog/jinja-281-released/
https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16

Comment 1 Marian Rehak 2019-04-10 07:54:59 UTC
Created python-jinja2 tracking bugs for this issue:

Affects: epel-6 [bug 1698346]
Affects: fedora-28 [bug 1698349]
Affects: fedora-29 [bug 1698350]


Created python3-jinja2 tracking bugs for this issue:

Affects: epel-6 [bug 1698347]
Affects: epel-7 [bug 1698348]

Comment 11 Riccardo Schirone 2019-04-18 13:29:38 UTC
Upstream patch:
https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16

Comment 12 Riccardo Schirone 2019-04-18 13:29:56 UTC
External References:

https://palletsprojects.com/blog/jinja-281-released/

Comment 17 Hardik Vyas 2019-04-22 09:34:58 UTC
Mitigation:

If you don't want or you cannot upgrade Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow all `format` attributes on strings.

Comment 23 errata-xmlrpc 2019-05-07 17:05:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1022 https://access.redhat.com/errata/RHSA-2019:1022

Comment 24 errata-xmlrpc 2019-05-16 12:56:33 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:1237 https://access.redhat.com/errata/RHSA-2019:1237

Comment 27 errata-xmlrpc 2019-05-22 12:01:53 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:1260 https://access.redhat.com/errata/RHSA-2019:1260

Comment 30 Hardik Vyas 2019-06-07 12:35:23 UTC
Red Hat Ceph Storage 2 and 3 will get the security fixes for python-jinja2 from RHEL7, hence changing state from affected:fix to affected:wontfix for Ceph.

Comment 31 Hardik Vyas 2019-06-07 12:35:29 UTC
Statement:

* Red Hat OpenStack Platform is not affected by this flaw. All supported versions ship python-jinja2 packages which have already been fixed.
* Red Hat Satellite 6 will receive fixes through the underlying Red Hat Enterprise Linux, so it will not issue updates to its own affected package.
* Red Hat Update Infrastructure is not affected because its packaged versions of python-jinja2 do not use the Sandbox feature, nor does it allow untrusted jinja2 templates.
* Red Hat Virtualization Management Appliance includes python-jinja2 as a dependency of ovirt-engine-backend, which only uses it with controlled format strings that are not exploitable.
* Red Hat Ceph Storage 2 and 3 are affected by this flaw as it contains the vulnerable code and will get security fixes for python-jinja2 from Red Hat Enterprise Linux 7 channel.