运行 MAIN 6.02 版本的远程 NewStart CGSL 主机上安装的 python-jinja2 程序包受到一个漏洞影响：

  - 在 2.10.1 之前的 Pallets Jinja 中，str.format_map 支持沙盒逃逸。(CVE-2019-10906)

请注意，Nessus 尚未测试此问题，而是只依靠应用程序自我报告的版本号来判断。

来自 Red Hat 安全公告 2019:1152： python-jinja2 的更新现在可用于 Red Hat Enterprise Linux 8。 Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。 python-jinja2 程序包包含 Jinja2，这是以纯粹 Python 所写的模板引擎。Jinja2 可提供受 Django 启发的非 XML 语法，但同时支持内联表达式和可选沙盒环境。 安全补丁： * python-jinja2：str.format_map 允许沙盒逃逸 (CVE-2019-10906) 有关此安全问题的详细信息，包括其影响、CVSS 分数、致谢和其他相关信息，请参阅列于“参考”部分的 CVE 页面。

Olivier Dony 发现 Jinja 未正确处理 str.format。攻击者可能利用此问题避开沙盒。此问题仅影响 Ubuntu 16.04 LTS。(CVE-2016-10745)

Brian Welch 发现 Jinja 未能正确处理 str.format_map。
攻击者可能利用此问题避开沙盒。
(CVE-2019-10906)

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

來自 Red Hat 安全性公告 2019:1152： 現已提供適用於 Red Hat Enterprise Linux 8 的 python-jinja2 更新。 Red Hat 產品安全性團隊已將此更新評等為具有重要安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。 python-jinja2 套件包含 Jinja2，這是以純粹 Python 所撰寫的範本引擎。Jinja2 提供源於 Django 的非 XML 語法，但支援內嵌運算式和一個選用沙箱化環境。 安全性修正： * python-jinja2：str.format_map 允許沙箱逸出 (CVE-2019-10906) 如需安全性問題的詳細資料，包括影響、CVSS 分數、確認及其他相關資訊，請參閱〈參照〉一節列出的 CVE 頁面。

執行 MAIN 6.02 版的遠端 NewStart CGSL 主機上安裝的 python-jinja2 套件受到一個弱點影響：

  - 在 Pallets Jinja 2.10.1 之前版本中，str.format_map 允許發生沙箱逸出。(CVE-2019-10906)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端 Rocky Linux 8 主機已安裝一個受到 RLSA-2019:1152 公告中所提及的弱點影響的套件。

  - 在 Pallets Jinja 2.10.1 之前版本中，str.format_map 允許發生沙箱逸出。(CVE-2019-10906)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Olivier Dony 發現 Jinja 未正確處理 str.format。攻擊者可能會利用此問題來逸出沙箱。這個問題只會影響 Ubuntu 16.04 LTS。(CVE-2016-10745)

Brian Welch 發現 Jinja 未正確處理 str.format_map。
攻擊者可能會利用此問題來逸出沙箱。
(CVE-2019-10906).

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3172 advisory.

    Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning,     remote management, and monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):

    * rubygem-rack: Buffer size in multipart parser allows for denial of service (CVE-2018-16470)

    * dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity     of XML documents (CVE-2018-1000632)

    * foreman: authorization bypasses in foreman-tasks leading to information disclosure (CVE-2019-10198)

    * katello: registry credentials are captured in plain text during repository discovery (CVE-2019-14825)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    This update also fixes several bugs and adds various enhancements. Documentation for these changes is     available from the Release Notes document linked to in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the python-jinja2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Pallets Jinja before 2.10.1, str.format_map allows a     sandbox escape.(CVE-2019-10906)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Alibaba Cloud Linux 3 host has a package installed that is affected by a vulnerability as referenced in the ALINUX3-SA-2022:0066 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-10906:
    In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3-jinja2 installed on the remote host is prior to 2.7.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2582 advisory.

    In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape. (CVE-2019-10906)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for python-Jinja2 to version 2.10.1 fixes the following issues :

Security issues fixed :

  - CVE-2019-8341: Fixed a command injection in     from_string() (bsc#1125815).

  - CVE-2019-10906: Fixed a sandbox escape due to     information disclosure via str.format (bsc#1132323).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-Jinja2 fixes the following issues :

Security issues fixed :

  - CVE-2016-10745: Fixed a sandbox escape caused by an     information disclosure via str.format (bsc#1132174).

  - CVE-2019-10906: Fixed a sandbox escape due to     information disclosure via str.format (bsc#1132323).

  - CVE-2019-8341: Fixed command injection in function     from_string (bsc#1125815).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
154639	NewStart CGSL MAIN 6.02：python-jinja2 漏洞 (NS-SA-2021-0131)	Nessus	NewStart CGSL Local Security Checks	2021/10/28	2021/10/28	high
127582	Oracle Linux 8 : python-jinja2 (ELSA-2019-1152)	Nessus	Oracle Linux Local Security Checks	2019/8/12	2024/11/1	high
125771	Ubuntu 16.04 LTS / 18.04 LTS：Jinja2 漏洞 (USN-4011-1)	Nessus	Ubuntu Local Security Checks	2019/6/7	2025/9/3	high
127582	Oracle Linux 8 : python-jinja2 (ELSA-2019-1152)	Nessus	Oracle Linux Local Security Checks	2019/8/12	2024/11/1	high
154639	NewStart CGSL MAIN 6.02：python-jinja2 弱點 (NS-SA-2021-0131)	Nessus	NewStart CGSL Local Security Checks	2021/10/28	2021/10/28	high
184504	Rocky Linux 8python-jinja2 (RLSA-2019:1152)	Nessus	Rocky Linux Local Security Checks	2023/11/6	2023/11/6	high
125771	Ubuntu 16.04 LTS / 18.04 LTS：Jinja2 弱點 (USN-4011-1)	Nessus	Ubuntu Local Security Checks	2019/6/7	2025/9/3	high
130187	RHEL 7 : Red Hat Satellite 6 (RHSA-2019:3172)	Nessus	Red Hat Local Security Checks	2019/10/24	2024/11/7	high
133928	EulerOS 2.0 SP5 : python-jinja2 (EulerOS-SA-2020-1127)	Nessus	Huawei Local Security Checks	2020/2/24	2024/3/26	high
236601	Alibaba Cloud Linux 3 : 0066: python-jinja2 (ALINUX3-SA-2022:0066)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium
200903	Amazon Linux 2 : python3-jinja2 (ALAS-2024-2582)	Nessus	Amazon Linux Local Security Checks	2024/6/24	2024/12/11	high
125022	openSUSE Security Update : python-Jinja2 (openSUSE-2019-1395)	Nessus	SuSE Local Security Checks	2019/5/14	2024/5/22	critical
126233	openSUSE Security Update : python-Jinja2 (openSUSE-2019-1614)	Nessus	SuSE Local Security Checks	2019/6/25	2024/5/14	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

medium

high

critical

critical