Publish GHSA-q2x7-8rv6-6q7h

2026-05-22 18:04:22 -07:00 · 2024-12-23 17:58:34 +00:00
parent 64f68f874c
commit 525faff642
1 changed files with 62 additions and 0 deletions
@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q2x7-8rv6-6q7h",
+  "modified": "2024-12-23T17:56:08Z",
+  "published": "2024-12-23T17:56:08Z",
+  "aliases": [
+    "CVE-2024-56326"
+  ],
+  "summary": "Jinja has a sandbox breakout through indirect reference to format method",
+  "details": "An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code.\n\nTo exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.\n\nJinja's sandbox does catch calls to `str.format` and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's `format` method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "jinja2"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "3.1.5"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 3.1.4"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/pallets/jinja"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-23T17:56:08Z",
+    "nvd_published_at": null
+  }
+}