In Pallets Jinja before 2.8.1, str.format allows a sandbox escape. The core of the issue is that Python's string format method that was added to strings can be used to discover potentially dangerous values including configuration values. References: https://nvd.nist.gov/vuln/detail/CVE-2016-10745 https://palletsprojects.com/blog/jinja-281-released/ https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16
Created python-jinja2 tracking bugs for this issue: Affects: epel-6 [bug 1698346] Affects: fedora-28 [bug 1698349] Affects: fedora-29 [bug 1698350] Created python3-jinja2 tracking bugs for this issue: Affects: epel-6 [bug 1698347] Affects: epel-7 [bug 1698348]
Upstream patch: https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16
External References: https://palletsprojects.com/blog/jinja-281-released/
Mitigation: If you don't want or you cannot upgrade Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow all `format` attributes on strings.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:1022 https://access.redhat.com/errata/RHSA-2019:1022
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:1237 https://access.redhat.com/errata/RHSA-2019:1237
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:1260 https://access.redhat.com/errata/RHSA-2019:1260
Red Hat Ceph Storage 2 and 3 will get the security fixes for python-jinja2 from RHEL7, hence changing state from affected:fix to affected:wontfix for Ceph.
Statement: * Red Hat OpenStack Platform is not affected by this flaw. All supported versions ship python-jinja2 packages which have already been fixed. * Red Hat Satellite 6 will receive fixes through the underlying Red Hat Enterprise Linux, so it will not issue updates to its own affected package. * Red Hat Update Infrastructure is not affected because its packaged versions of python-jinja2 do not use the Sandbox feature, nor does it allow untrusted jinja2 templates. * Red Hat Virtualization Management Appliance includes python-jinja2 as a dependency of ovirt-engine-backend, which only uses it with controlled format strings that are not exploitable. * Red Hat Ceph Storage 2 and 3 are affected by this flaw as it contains the vulnerable code and will get security fixes for python-jinja2 from Red Hat Enterprise Linux 7 channel.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.5 Extended Update Support Via RHSA-2019:3964 https://access.redhat.com/errata/RHSA-2019:3964
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions Red Hat Enterprise Linux 7.4 Telco Extended Update Support Via RHSA-2019:4062 https://access.redhat.com/errata/RHSA-2019:4062