| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| jinja2 | < 2.10.1 | 2.10.1 |
| jinja | < 2.10.1 | 2.10.1 |
| software collections | = 1.0 |
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.
The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the str.format_map method could be used to escape the sandbox.
This issue was previously addressed for the str.format method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common str.format_map method was overlooked. This release applies the same sandboxing to both methods.
If you cannot upgrade Jinja, you can override the is_safe_attribute method on the sandbox and explicitly disallow the format_map method on string objects.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン