USN-4011-1: Jinja2 vulnerabilities
Olivier Dony discovered that Jinja incorrectly handled str.format. An attacker could possibly use this issue to escape the sandbox. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10745) Brian Welch discovered that Jinja incorrectly handled str.formatmap. An attacker could possibly use this issue to escape the sandbox. (CVE-2019-10906)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/python-jinja2to a version that resolves this vulnerability.Fixed in 2.10-1ubuntu0.19.04.1 - Upgrade
Upgrade
ubuntu/python3-jinja2to a version that resolves this vulnerability.Fixed in 2.10-1ubuntu0.19.04.1 - Upgrade
Upgrade
ubuntu/python-jinja2to a version that resolves this vulnerability.Fixed in 2.10-1ubuntu0.18.10.1 - Upgrade
Upgrade
ubuntu/python3-jinja2to a version that resolves this vulnerability.Fixed in 2.10-1ubuntu0.18.10.1 - Upgrade
Upgrade
ubuntu/python-jinja2to a version that resolves this vulnerability.Fixed in 2.10-1ubuntu0.18.04.1 - Upgrade
Upgrade
ubuntu/python3-jinja2to a version that resolves this vulnerability.Fixed in 2.10-1ubuntu0.18.04.1 - Upgrade
Upgrade
ubuntu/python-jinja2to a version that resolves this vulnerability.Fixed in 2.8-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/python3-jinja2to a version that resolves this vulnerability.Fixed in 2.8-1ubuntu0.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this security notice?
The vulnerability ID for this security notice is USN-4011-1.
What is the severity level of this vulnerability?
The severity level of this vulnerability is not mentioned.
What is the description of this vulnerability?
The vulnerability is related to Jinja2 and it incorrectly handles str.format and str.format_map, which could allow an attacker to escape the sandbox.
Which versions of Ubuntu are affected by this vulnerability?
This vulnerability only affects Ubuntu 16.04 LTS, Ubuntu 18.04, and Ubuntu 19.04.
How can I fix this vulnerability?
To fix this vulnerability, update the python-jinja2 and python3-jinja2 packages to version 2.10-1ubuntu0.19.04.1 for Ubuntu 19.04, version 2.10-1ubuntu0.18.10.1 for Ubuntu 18.10, version 2.10-1ubuntu0.18.04.1 for Ubuntu 18.04, and version 2.8-1ubuntu0.1 for Ubuntu 16.04.