Bug 1698345 (CVE-2016-10745) - CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format
Summary: CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure vi...
Status: CLOSED ERRATA
Alias: CVE-2016-10745
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20161229,repo...
Keywords: Reopened, Security
Depends On: 1698346 1701309 1698347 1698348 1698349 1698350 1701043 1701044 1701047 1701048 1701126 1701127 1701179 1701308 1701310 1701311 1701312 1701313
Blocks: 1698351
TreeView+ depends on / blocked
 
Reported: 2019-04-10 07:54 UTC by Marian Rehak
Modified: 2019-07-17 14:15 UTC (History)
42 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2019-06-10 10:53:50 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:1376 None None None 2019-06-05 14:45 UTC
Red Hat Product Errata RHBA-2019:1395 None None None 2019-06-06 13:09 UTC
Red Hat Product Errata RHSA-2019:1022 None None None 2019-05-07 17:06 UTC
Red Hat Product Errata RHSA-2019:1237 None None None 2019-05-16 12:56 UTC
Red Hat Product Errata RHSA-2019:1260 None None None 2019-05-22 12:01 UTC

Description Marian Rehak 2019-04-10 07:54:36 UTC
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

The core of the issue is that Python's string format method that was added to strings can be used to discover potentially dangerous values including configuration values.

References:
https://nvd.nist.gov/vuln/detail/CVE-2016-10745
https://palletsprojects.com/blog/jinja-281-released/
https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16

Comment 1 Marian Rehak 2019-04-10 07:54:59 UTC
Created python-jinja2 tracking bugs for this issue:

Affects: epel-6 [bug 1698346]
Affects: fedora-28 [bug 1698349]
Affects: fedora-29 [bug 1698350]


Created python3-jinja2 tracking bugs for this issue:

Affects: epel-6 [bug 1698347]
Affects: epel-7 [bug 1698348]

Comment 11 Riccardo Schirone 2019-04-18 13:29:38 UTC
Upstream patch:
https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16

Comment 12 Riccardo Schirone 2019-04-18 13:29:56 UTC
External References:

https://palletsprojects.com/blog/jinja-281-released/

Comment 17 Hardik Vyas 2019-04-22 09:34:58 UTC
Mitigation:

If you don't want or you cannot upgrade Jinja2, you can override the `is_safe_attribute` method on the sandbox and explicitly disallow all `format` attributes on strings.

Comment 23 errata-xmlrpc 2019-05-07 17:05:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1022 https://access.redhat.com/errata/RHSA-2019:1022

Comment 24 errata-xmlrpc 2019-05-16 12:56:33 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:1237 https://access.redhat.com/errata/RHSA-2019:1237

Comment 27 errata-xmlrpc 2019-05-22 12:01:53 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 6
  Red Hat Software Collections for Red Hat Enterprise Linux 7
  Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS
  Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS

Via RHSA-2019:1260 https://access.redhat.com/errata/RHSA-2019:1260

Comment 30 Hardik Vyas 2019-06-07 12:35:23 UTC
Red Hat Ceph Storage 2 and 3 will get the security fixes for python-jinja2 from RHEL7, hence changing state from affected:fix to affected:wontfix for Ceph.

Comment 31 Hardik Vyas 2019-06-07 12:35:29 UTC
Statement:

* Red Hat OpenStack Platform is not affected by this flaw. All supported versions ship python-jinja2 packages which have already been fixed.
* Red Hat Satellite 6 will receive fixes through the underlying Red Hat Enterprise Linux, so it will not issue updates to its own affected package.
* Red Hat Update Infrastructure is not affected because its packaged versions of python-jinja2 do not use the Sandbox feature, nor does it allow untrusted jinja2 templates.
* Red Hat Virtualization Management Appliance includes python-jinja2 as a dependency of ovirt-engine-backend, which only uses it with controlled format strings that are not exploitable.
* Red Hat Ceph Storage 2 and 3 are affected by this flaw as it contains the vulnerable code and will get security fixes for python-jinja2 from Red Hat Enterprise Linux 7 channel.


Note You need to log in before you can comment on or make changes to this bug.