CVE-2019-10906: High severity palletsprojects Jinja vulnerability
In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape.
The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the str.formatmap method could be used to escape the sandbox.
This issue was previously addressed for the str.format method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common str.formatmap method was overlooked. This release applies the same sandboxing to both methods.
If you cannot upgrade Jinja, you can override the issafeattribute method on the sandbox and explicitly disallow the formatmap method on string objects.
Other sources
In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape ...
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jinjato a version that resolves this vulnerability.Fixed in 2.10.1 - Upgrade
Upgrade
pip/Jinja2to a version that resolves this vulnerability.Fixed in 2.10.1 - Upgrade
Upgrade
debian/jinja2to a version that resolves this vulnerability.Fixed in 2.11.3-1Fixed in 2.11.3-1+deb11u4Fixed in 3.1.2-1+deb12u3Fixed in 3.1.6-1Fixed in 3.1.6-3 - Upgrade
Upgrade
pallets/jinjato a version that resolves this vulnerability.Fixed in 2.10.1 - Configuration
If you cannot upgrade, override the sandbox is_safe_attribute method and explicitly disallow the str.format_map method on string objects to prevent sandbox escape.
Jinja sandbox (is_safe_attribute override) disallow str.format_map on string objects = explicitly disallow - Compensating control
If you cannot upgrade, use the sandbox override (is_safe_attribute) to restrict rendering of untrusted, user-provided templates so that str.format_map cannot be used for sandbox escape.
Event History
Frequently Asked Questions
What is CVE-2019-10906?
CVE-2019-10906 is a vulnerability in Pallets Jinja before version 2.10.1 that allows a sandbox escape.
How severe is CVE-2019-10906?
CVE-2019-10906 has a severity rating of 8.6, which is considered high.
What is the affected software for CVE-2019-10906?
The affected software for CVE-2019-10906 includes Pallets Jinja versions before 2.10.1, Jinja2 packages with versions less than 2.10.1 on Ubuntu, and Jinja packages with versions less than 2.10.1 on Redhat.
How can I fix CVE-2019-10906?
To fix CVE-2019-10906, make sure to upgrade to Pallets Jinja version 2.10.1 or later, Jinja2 package version 2.10.1 or later on Ubuntu, or Jinja package version 2.10.1 or later on Redhat.
Where can I find more information on CVE-2019-10906?
You can find more information on CVE-2019-10906 at the following references: [link1], [link2], [link3].