CVE-2020-28493: Regular Expression Denial of Service (ReDoS)

Q: What is CVE-2020-28493?

CVE-2020-28493 is a vulnerability in the Python Jinja2 package that allows for ReDoS attacks due to the use of multiple wildcards in the regex operator.

Q: What is the severity of CVE-2020-28493?

CVE-2020-28493 has a severity rating of high with a score of 7.

Q: How does CVE-2020-28493 affect the python-jinja2 package?

CVE-2020-28493 affects the python-jinja2 package versions 0.0.0 to 2.11.3.

Q: What is the risk of CVE-2020-28493?

CVE-2020-28493 poses a risk of denial of service attacks through ReDoS vulnerabilities.

Q: How can I mitigate CVE-2020-28493?

You can mitigate CVE-2020-28493 by updating the python-jinja2 package to version 2.11.3 or higher.

Published Feb 1, 2021

Updated

A flaw was found in python-jinja2. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9.-]+.[a-zA-Z0-9.-]+. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

Other sources

Regular Expression Denial of Service (ReDoS)

— Microsoft

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the punctuationre regex operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

— Ubuntu

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9.-]+.[a-zA-Z0-9.-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

— GitHub

Affected Software

25 affected componentsFixes available

redhat/python-jinja2<0:2.10.1-3.el8

0:2.10.1-3.el8

redhat/python27-babel<0:0.9.6-10.el7

0:0.9.6-10.el7

redhat/python27-python<0:2.7.18-3.el7

0:2.7.18-3.el7

redhat/python27-python-jinja2<0:2.6-16.el7

0:2.6-16.el7

redhat/python27-python-pygments<0:1.5-5.el7

0:1.5-5.el7

redhat/rh-python38-babel<0:2.7.0-12.el7

0:2.7.0-12.el7

redhat/rh-python38-python<0:3.8.11-2.el7

0:3.8.11-2.el7

redhat/rh-python38-python-cryptography<0:2.8-5.el7

0:2.8-5.el7

redhat/rh-python38-python-jinja2<0:2.10.3-6.el7

0:2.10.3-6.el7

redhat/rh-python38-python-lxml<0:4.4.1-7.el7

0:4.4.1-7.el7

redhat/rh-python38-python-pip<0:19.3.1-2.el7

0:19.3.1-2.el7

redhat/rh-python38-python-urllib3<0:1.25.7-7.el7

0:1.25.7-7.el7

redhat/jinja2<2.11.3

2.11.3

debian/jinja2<=2.10-2, <=2.10-2+deb10u1

2.11.3-13.1.2-13.1.3-1

ubuntu/jinja2<2.10-1ubuntu0.18.04.1+

2.10-1ubuntu0.18.04.1+

ubuntu/jinja2<2.10.1-2ubuntu0.2

2.10.1-2ubuntu0.2

ubuntu/jinja2<2.7.2-2ubuntu0.1~

2.7.2-2ubuntu0.1~

ubuntu/jinja2<2.11.3

2.11.3

ubuntu/jinja2<2.8-1ubuntu0.1+

2.8-1ubuntu0.1+

pip/jinja2<2.11.3

2.11.3

palletsprojects Jinja<2.11.3

Fedoraproject Fedora=33

Microsoft azl3 nodejs 20.14.0-1

Patch available

Microsoft cm1 python-jinja2 2.11.3-1

Patch available

Microsoft azl3 nodejs 20.14.0-8

Patch available

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/python-jinja2 to a version that resolves this vulnerability.
Fixed in 0:2.10.1-3.el8
Upgrade
Upgrade redhat/python27-babel to a version that resolves this vulnerability.
Fixed in 0:0.9.6-10.el7
Upgrade
Upgrade redhat/python27-python to a version that resolves this vulnerability.
Fixed in 0:2.7.18-3.el7
Upgrade
Upgrade redhat/python27-python-jinja2 to a version that resolves this vulnerability.
Fixed in 0:2.6-16.el7
Upgrade
Upgrade redhat/python27-python-pygments to a version that resolves this vulnerability.
Fixed in 0:1.5-5.el7
Upgrade
Upgrade redhat/rh-python38-babel to a version that resolves this vulnerability.
Fixed in 0:2.7.0-12.el7
Upgrade
Upgrade redhat/rh-python38-python to a version that resolves this vulnerability.
Fixed in 0:3.8.11-2.el7
Upgrade
Upgrade redhat/rh-python38-python-cryptography to a version that resolves this vulnerability.
Fixed in 0:2.8-5.el7
Upgrade
Upgrade redhat/rh-python38-python-jinja2 to a version that resolves this vulnerability.
Fixed in 0:2.10.3-6.el7
Upgrade
Upgrade redhat/rh-python38-python-lxml to a version that resolves this vulnerability.
Fixed in 0:4.4.1-7.el7
Upgrade
Upgrade redhat/rh-python38-python-pip to a version that resolves this vulnerability.
Fixed in 0:19.3.1-2.el7
Upgrade
Upgrade redhat/rh-python38-python-urllib3 to a version that resolves this vulnerability.
Fixed in 0:1.25.7-7.el7
Upgrade
Upgrade redhat/jinja2 to a version that resolves this vulnerability.
Fixed in 2.11.3
Upgrade
Upgrade debian/jinja2 to a version that resolves this vulnerability.
Fixed in 2.11.3-1Fixed in 3.1.2-1Fixed in 3.1.3-1
Upgrade
Upgrade ubuntu/jinja2 to a version that resolves this vulnerability.
Fixed in 2.10-1ubuntu0.18.04.1+
Upgrade
Upgrade ubuntu/jinja2 to a version that resolves this vulnerability.
Fixed in 2.10.1-2ubuntu0.2
Upgrade
Upgrade ubuntu/jinja2 to a version that resolves this vulnerability.
Fixed in 2.7.2-2ubuntu0.1~
Upgrade
Upgrade ubuntu/jinja2 to a version that resolves this vulnerability.
Fixed in 2.11.3
Upgrade
Upgrade ubuntu/jinja2 to a version that resolves this vulnerability.
Fixed in 2.8-1ubuntu0.1+
Upgrade
Upgrade pip/jinja2 to a version that resolves this vulnerability.
Fixed in 2.11.3
Upgrade
Upgrade jinja2 to a version that resolves this vulnerability.
Fixed in 2.11.3
Configuration
Do not use the vulnerable urlize() filter; use Markdown to format user content instead.
python-jinja2 urlize() filter = disabled
Compensating control
Implement request timeouts and limit process memory to mitigate ReDoS exploitation.

Event History

Feb 1, 2021

CVE Published

12:00 AM

CVE Published

via MITRE·07:30 PM

Data Sourced

via MITRE·07:30 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Mar 19, 2021

Advisory Published

via GitHub·09:28 PM

Jun 9, 2022

Data Sourced

via Microsoft·07:00 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2020-28493?

CVE-2020-28493 is a vulnerability in the Python Jinja2 package that allows for ReDoS attacks due to the use of multiple wildcards in the regex operator.

What is the severity of CVE-2020-28493?

CVE-2020-28493 has a severity rating of high with a score of 7.

How does CVE-2020-28493 affect the python-jinja2 package?

CVE-2020-28493 affects the python-jinja2 package versions 0.0.0 to 2.11.3.

What is the risk of CVE-2020-28493?

CVE-2020-28493 poses a risk of denial of service attacks through ReDoS vulnerabilities.

How can I mitigate CVE-2020-28493?

You can mitigate CVE-2020-28493 by updating the python-jinja2 package to version 2.11.3 or higher.

CVE-2020-28493: Regular Expression Denial of Service (ReDoS)

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is CVE-2020-28493?

What is the severity of CVE-2020-28493?

How does CVE-2020-28493 affect the python-jinja2 package?

What is the risk of CVE-2020-28493?

How can I mitigate CVE-2020-28493?

Company

Resources

Contact