要点
- CVE-2024-56201 は jinja2, jinja (palletsprojects) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.31%（全脆弱性の 23.5% より高い）。
- 対処：3.1.5 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| jinja2 PyPI | ≥ 3.0.0, < 3.1.5
| 3.1.5
|
| jinja | ≥ 3.0.0, < 3.1.5
| 3.1.5
|
概要
A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used.
To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename.
NVD の説明
Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン