CVE-2016-10745

Description (CNA)

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

Affected (CNA)

CWE

No CWE identifiers supplied.

References

• https://palletsprojects.com/blog/jinja-281-released/
• https://github.com/pallets/jinja/commit/9b53045c34e61013dc8f09b7e52a555fa16bed16
• https://access.redhat.com/errata/RHSA-2019:1022
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html
• https://access.redhat.com/errata/RHSA-2019:1237
• https://access.redhat.com/errata/RHSA-2019:1260
• https://usn.ubuntu.com/4011-1/
• https://usn.ubuntu.com/4011-2/
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html
• https://access.redhat.com/errata/RHSA-2019:3964
• https://access.redhat.com/errata/RHSA-2019:4062

ADP enrichment