CVE-2019-10906

State: Published
Severity: Not scored
Published: Apr 6, 2019
Updated: Aug 4, 2024
Reserved: Apr 6, 2019

Read the record on cve.org

Description

In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://palletsprojects.com/blog/jinja-2-10-1-released
[infra-devnull] 20190410 [GitHub] [airflow] XD-DENG opened pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906mailing-list
[airflow-commits] 20190410 [GitHub] [airflow] XD-DENG opened a new pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906mailing-list
[airflow-commits] 20190410 [GitHub] [airflow] XD-DENG commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906mailing-list
[airflow-commits] 20190410 [GitHub] [airflow] ashb commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906mailing-list
[infra-devnull] 20190410 [GitHub] [airflow] XD-DENG commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906mailing-list
[infra-devnull] 20190410 [GitHub] [airflow] ashb commented on issue #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906mailing-list
[airflow-commits] 20190410 [GitHub] [airflow] ashb merged pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906mailing-list
[infra-devnull] 20190410 [GitHub] [airflow] ashb closed pull request #5075: [AIRFLOW-XXX] Change allowed version of Jinja2 to fix CVE-2019-10906mailing-list
FEDORA-2019-4f978cacb4vendor-advisory
FEDORA-2019-e41e19457bvendor-advisory
FEDORA-2019-04a42e480bvendor-advisory
RHSA-2019:1152vendor-advisory
openSUSE-SU-2019:1395vendor-advisory
RHSA-2019:1237vendor-advisory
RHSA-2019:1329vendor-advisory
USN-4011-1vendor-advisory
USN-4011-2vendor-advisory
openSUSE-SU-2019:1614vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.