USN-6599-1: Jinja2 vulnerabilities

Packages

jinja2 - small but fast and easy to use stand-alone template engine

Details

Yeting Li discovered that Jinja incorrectly handled certain regex.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS. (CVE-2020-28493)

It was discovered that Jinja incorrectly handled certain HTML passed with
xmlatter filter. An attacker could inject arbitrary HTML attributes
keys and values potentially leading to XSS. (CVE-2024-22195)

Yeting Li discovered that Jinja incorrectly handled certain regex.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 18.04 LTS, and
Ubuntu 20.04 LTS. (CVE-2020-28493)

It was discovered that Jinja incorrectly handled certain HTML passed with
xmlatter filter. An attacker could inject arbitrary HTML attributes
keys and values potentially leading to XSS. (CVE-2024-22195)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
23.10 mantic	python3-jinja2 – 3.1.2-1ubuntu0.23.10.1
22.04 jammy	python3-jinja2 – 3.0.3-1ubuntu0.1
20.04 focal	python-jinja2 – 2.10.1-2ubuntu0.2
20.04 focal	python3-jinja2 – 2.10.1-2ubuntu0.2
18.04 bionic	python-jinja2 – 2.10-1ubuntu0.18.04.1+esm1
18.04 bionic	python3-jinja2 – 2.10-1ubuntu0.18.04.1+esm1
16.04 xenial	python-jinja2 – 2.8-1ubuntu0.1+esm2
16.04 xenial	python3-jinja2 – 2.8-1ubuntu0.1+esm2
14.04 trusty	python-jinja2 – 2.7.2-2ubuntu0.1~esm2
14.04 trusty	python3-jinja2 – 2.7.2-2ubuntu0.1~esm2

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

USN-5701-1

USN-5701-1

Packages

Details

Update instructions

Reduce your security exposure

References

Related notices