CVE-2016-10745

python-jinja2: Sandbox escape due to information disclosure via str.format

Severity Score

8.6

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

En Pallets Jinja versiones anteriores a 2.8.1, str.format permite un scape de sandbox

A flaw was found in Pallets Jinja prior to version 2.8.1 allows sandbox escape. Python's string format method added to strings can be used to discover potentially dangerous values including configuration values. The highest threat from this vulnerability is to data confidentiality and integrity as well as system integrity.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Issues addressed include an information leakage vulnerability.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-04-08 CVE Reserved
2019-04-08 CVE Published
2024-08-06 CVE Updated
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-134: Use of Externally-Controlled Format String
CWE-138: Improper Neutralization of Special Elements

CAPEC

References (13)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16	2019-06-06

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html	2019-06-06
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html	2019-06-06
https://access.redhat.com/errata/RHSA-2019:1022	2019-06-06
https://access.redhat.com/errata/RHSA-2019:1237	2019-06-06
https://access.redhat.com/errata/RHSA-2019:1260	2019-06-06
https://access.redhat.com/errata/RHSA-2019:3964	2019-06-06
https://access.redhat.com/errata/RHSA-2019:4062	2019-06-06
https://palletsprojects.com/blog/jinja-281-released	2019-06-06
https://usn.ubuntu.com/4011-1	2019-06-06
https://usn.ubuntu.com/4011-2	2019-06-06
https://access.redhat.com/security/cve/CVE-2016-10745	2019-12-03
https://bugzilla.redhat.com/show_bug.cgi?id=1698345	2019-12-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Palletsprojects Search vendor "Palletsprojects"		Jinja Search vendor "Palletsprojects" for product "Jinja"				< 2.8.1 Search vendor "Palletsprojects" for product "Jinja" and version " < 2.8.1"		-		Affected