CVE-2019-10906

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the str.format_map method could be used to escape the sandbox.

This issue was previously addressed for the str.format method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common str.format_map method was overlooked. This release applies the same sandboxing to both methods.

If you cannot upgrade Jinja, you can override the is_safe_attribute method on the sandbox and explicitly disallow the format_map method on string objects.

The python-jinja2 package contains Jinja2, a template engine written in pure Python. Jinja2 provides a Django inspired non-XML syntax but supports inline expressions and an optional sandboxed environment.

Security Fix(es):

• python-jinja2: str.format_map allows sandbox escape (CVE-2019-10906)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

Sandbox escape due to information disclosure via str.format (CVE-2016-10745). str.format_map allows sandbox escape (CVE-2019-10906).

This update for python-Jinja2 to version 2.10.1 fixes the following issues:

Security issues fixed:

• CVE-2019-8341: Fixed a command injection in from_string() (bsc#1125815).
• CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format (bsc#1132323).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the python36-Jinja2-3.0.1-3.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Jinja2-3.1.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Jinja2-3.1.6-2.4 package on the GA media of openSUSE Tumbleweed.

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Track already fixed issues.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for python-Jinja2 to version 2.10.1 fixes the following issues:

Security issues fixed:

• CVE-2019-8341: Fixed a command injection in from_string() (bsc#1125815).
• CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format (bsc#1132323).

This update for python-Jinja2 fixes the following issues:

Security issues fixed:

• CVE-2016-10745: Fixed a sandbox escape caused by an information disclosure via str.format (bsc#1132174).
• CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format (bsc#1132323).
• CVE-2019-8341: Fixed command injection in function from_string (bsc#1125815).

This update for python-Jinja2 fixes the following issues:

• CVE-2019-10906: Fixed a sandbox escape due to information disclosure via str.format (bsc#1132323).
• CVE-2019-8341: Fixed a command injection in function from_string (bsc#1125815).

This update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark fixes the following issues:

Security changes included on this update:

grafana:

• CVE-2020-24303: Fixed an XXS with series overides. (bsc#1178243)

influxdb:

• CVE-2019-20933: Fixed an authentication bypass. (bsc#1178988)

python-Jinja2:

• CVE-2019-10906,CVE-2019-8341,CVE-2016-10745: 'SandboxedEnvironment' securely handles 'str.format_map' in order to prevent code execution through untrusted format strings. (bsc#1132323, bsc#1125815, bsc#1132174)

python-pysaml2:

• CVE-2020-5390: Fixed an issue where there was no check that the signature in a SAML document is enveloped. (bsc#1160851)

python-urllib3:

• CVE-2020-26137: Fixed a CRLF injection via HTTP request method. (bsc#1177120)

Non-security changes included in this update:

Changes in ardana-cassandra:

• Update to version 9.0+git.1600802664.7e480a2:
  • Remove freezer related backup/restore code (SOC-7751)

Changes in ardana-mq:

• Update to version 9.0+git.1605174486.a78ddce:
  • Re-enable mirroring of fanout and reply queues (bsc#1177611)

Changes in ardana-osconfig:

• Update to version 9.0+git.1601621747.a87e5a0:
  • HOS8 check needs to be a shell rather than command (SOC-11184)

Changes in ardana-tempest:

• Update to version 9.0+git.1603378983.fc0bca9:

  • Enable VPNaaS testing (SOC-8764)

• Update to version 9.0+git.1599855218.875b2f3:

  • unblacklist some revert tests (SOC-9178)

Changes in crowbar-core:

• Update to version 6.0+git.1606314264.bf9ada813:

  • ntp: Do not use rate-limiting (bsc#1179161)

• Update to version 6.0+git.1600414599.150832ca2:

  • Ignore CVE-2020-15169 (SOC-11391)

Changes in crowbar-openstack:

• Update to version 6.0+git.1604573541.bb18c172d:

  • rabbitmq: Fix crm running check (SOC-11240)

• Update to version 6.0+git.1604491402.b4dbba849:

  • Remove aspiers from CODEOWNERS
  • Remove cmurphy from CODEOWNERS

Changes in grafana:

• Fix bsc#1178243 CVE-2020-24303 by adding 25401-Fix-XSS-vulnerability-with-series-overrides.patch

Changes in influxdb:

• Add CVE-2019-20933.patch (bsc#1178988, CVE-2019-20933) to fix authentication bypass
• Declare license files correctly

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev20:

  • PowerMax Driver - Legacy volumes fail to live migrate

• Update to version cinder-13.0.10.dev19:

  • RBD: Cleanup temporary file during exception

• Update to version cinder-13.0.10.dev17:

  • Remove experimental job legacy-tempest-dsvm-zeromq-multibackend

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev20:

  • PowerMax Driver - Legacy volumes fail to live migrate

• Update to version cinder-13.0.10.dev19:

  • RBD: Cleanup temporary file during exception

• Update to version cinder-13.0.10.dev17:

  • Remove experimental job legacy-tempest-dsvm-zeromq-multibackend

Changes in openstack-heat:

• Update to version openstack-heat-11.0.4.dev4:

  • Check external resources after creation

• Update to version openstack-heat-11.0.4.dev2:

  • Don't store signal_url for ec2 signaling of deployments
  • Allow scale-down of ASG as part of update 11.0.3

Changes in openstack-heat:

• Update to version openstack-heat-11.0.4.dev4:

  • Check external resources after creation

• Update to version openstack-heat-11.0.4.dev2:

  • Don't store signal_url for ec2 signaling of deployments
  • Allow scale-down of ASG as part of update 11.0.3

Changes in openstack-heat-gbp:

• Update to version group-based-policy-automation-12.0.1.dev2:

  • Add support for victoria

• Update to version group-based-policy-automation-12.0.1.dev1: *…

Olivier Dony discovered that Jinja incorrectly handled str.format. An attacker could possibly use this issue to escape the sandbox. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10745)

Brian Welch discovered that Jinja incorrectly handled str.format_map. An attacker could possibly use this issue to escape the sandbox. (CVE-2019-10906)

USN-4011-1 fixed several vulnerabilities in Jinja2. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

Olivier Dony discovered that Jinja incorrectly handled str.format. An attacker could possibly use this issue to escape the sandbox. (CVE-2016-10745)

Brian Welch discovered that Jinja incorrectly handled str.format_map. An attacker could possibly use this issue to escape the sandbox. (CVE-2019-10906)