CVE-2024-22195

EUVD-2024-0365

11.01.2024, 03:15

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

Cross-site Scripting

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.4 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 35%

Affected Products (NVD)

Vendor	Product	Version
palletsprojects	jinja	𝑥 < 3.1.3

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

jinja2

bookworm	3.1.2-1+deb12u3 fixed
bullseye	vulnerable
bullseye (security)	2.11.3-1+deb11u4 fixed
forky	3.1.6-1 fixed
sid	3.1.6-1 fixed
trixie	3.1.6-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

jinja2

bionic	Fixed 2.10-1ubuntu0.18.04.1+esm1 released
focal	Fixed 2.10.1-2ubuntu0.2 released
jammy	Fixed 3.0.3-1ubuntu0.1 released
lunar	ignored
mantic	Fixed 3.1.2-1ubuntu0.23.10.1 released
noble	Fixed 3.1.2-1ubuntu1 released
oracular	Fixed 3.1.2-1ubuntu1 released
plucky	Fixed 3.1.2-1ubuntu1 released
trusty	Fixed 2.7.2-2ubuntu0.1~esm2 released
xenial	Fixed 2.8-1ubuntu0.1+esm2 released

openSUSE / SLES Releases

openSUSE Product

Release

python3-Jinja2

suse enterprise server 15 SP4

2.10.1-150000.3.13.1

fixed

python311-Jinja2

suse enterprise server 15 SP4

3.1.2-150400.12.6.1

fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

fence-agents-aliyun

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-all

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-amt-ws

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-apc

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-apc-snmp

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-aws

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-azure-arm

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-bladecenter

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-brocade

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-cisco-mds

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-cisco-ucs

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-common

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-compute

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-drac5

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-eaton-snmp

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-emerson

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-eps

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-gce

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-heuristics-ping

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-hpblade

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-ibm-powervs

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-ibm-vpc

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-ibmblade

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-ifmib

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-ilo-moonshot

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-ilo-mp

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-ilo-ssh

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-ilo2

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-intelmodular

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-ipdu

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-ipmilan

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-kdump

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-kubevirt

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-lpar

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-mpath

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-openstack

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-redfish

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-rhevm

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-rsa

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-rsb

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-sbd

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-scsi

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-virsh

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-vmware-rest

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-vmware-soap

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-wti

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-agents-zvm

RHEL 8	0:4.2.1-129.el8 fixed
RHEL 9	0:4.10.0-62.el9 fixed

fence-virt

RHEL 9

0:4.10.0-62.el9

fixed

fence-virtd

RHEL 9

0:4.10.0-62.el9

fixed

fence-virtd-cpg

RHEL 9

0:4.10.0-62.el9

fixed

fence-virtd-libvirt

RHEL 9

0:4.10.0-62.el9

fixed

fence-virtd-multicast

RHEL 9

0:4.10.0-62.el9

fixed

fence-virtd-serial

RHEL 9

0:4.10.0-62.el9

fixed

fence-virtd-tcp

RHEL 9

0:4.10.0-62.el9

fixed

ha-cloud-support

RHEL 9

0:4.10.0-62.el9

fixed

python3-jinja2

RHEL 9

0:2.11.3-5.el9

fixed

Common Weakness Enumeration

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References

https://github.com/pallets/jinja/releases/tag/3.1.3

https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95

https://lists.debian.org/debian-lts-announce/2024/01/msg00010.html

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3/

https://github.com/pallets/jinja/releases/tag/3.1.3

https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95

https://lists.debian.org/debian-lts-announce/2024/01/msg00010.html

https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5XCWZD464AJJJUBOO7CMPXQ4ROBC6JX2/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DELCVUUYX75I5K4Q5WMJG4MUZJA6VAIP/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O7YWRBX6JQCWC2XXCTZ55C7DPMGICCN3/