Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.1763
Important: rh-python35-python-jinja2 security update
17 May 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: rh-python35-python-jinja2
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 6
Red Hat Enterprise Linux WS/Desktop 6
Red Hat Enterprise Linux Server 7
Red Hat Enterprise Linux WS/Desktop 7
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2019-10906 CVE-2016-10745
Reference: ESB-2019.1673
ESB-2019.1609
ESB-2019.1578
Original Bulletin:
https://access.redhat.com/errata/RHSA-2019:1237
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: rh-python35-python-jinja2 security update
Advisory ID: RHSA-2019:1237-01
Product: Red Hat Software Collections
Advisory URL: https://access.redhat.com/errata/RHSA-2019:1237
Issue date: 2019-05-16
CVE Names: CVE-2016-10745 CVE-2019-10906
=====================================================================
1. Summary:
An update for rh-python35-python-jinja2 is now available for Red Hat
Software Collections.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch
3. Description:
The rh-python35-python-jinja2 package contains Jinja2, a template engine
written in pure Python. Jinja2 provides a Django inspired non-XML syntax
but supports inline expressions and an optional sandboxed environment.
Security Fix(es):
* python-jinja2: Sandbox escape due to information disclosure via
str.format (CVE-2016-10745)
* python-jinja2: str.format_map allows sandbox escape (CVE-2019-10906)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
For the update to take effect, all applications using Jinja2 must be
restarted.
5. Bugs fixed (https://bugzilla.redhat.com/):
1698345 - CVE-2016-10745 python-jinja2: Sandbox escape due to information disclosure via str.format
1698839 - CVE-2019-10906 python-jinja2: str.format_map allows sandbox escape
6. Package List:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):
Source:
rh-python35-python-jinja2-2.8.1-2.el6.src.rpm
noarch:
rh-python35-python-jinja2-2.8.1-2.el6.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):
Source:
rh-python35-python-jinja2-2.8.1-2.el6.src.rpm
noarch:
rh-python35-python-jinja2-2.8.1-2.el6.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source:
rh-python35-python-jinja2-2.8.1-2.el7.src.rpm
noarch:
rh-python35-python-jinja2-2.8.1-2.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4):
Source:
rh-python35-python-jinja2-2.8.1-2.el7.src.rpm
noarch:
rh-python35-python-jinja2-2.8.1-2.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5):
Source:
rh-python35-python-jinja2-2.8.1-2.el7.src.rpm
noarch:
rh-python35-python-jinja2-2.8.1-2.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6):
Source:
rh-python35-python-jinja2-2.8.1-2.el7.src.rpm
noarch:
rh-python35-python-jinja2-2.8.1-2.el7.noarch.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source:
rh-python35-python-jinja2-2.8.1-2.el7.src.rpm
noarch:
rh-python35-python-jinja2-2.8.1-2.el7.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-10745
https://access.redhat.com/security/cve/CVE-2019-10906
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXN1eJNzjgjWX9erEAQhZNg/+O3yKCapR6ClTRb7cRku3D8S0TD7rjzbC
2+jjcg+FhWVwaKi3+2vTVMYbxSNWB300I5JXBs/0jKm4qUKXTbxSOSzTLFzeXbc2
qfI3+48LjnsvnFfGad5J/C6dhc4t4gllW+qSO/AGvPBpky9qd1hklyIOI4b0Bpk4
NU2XigUbOyJrMX3VRmTfd4zECyZ5U1KdM8W71XDtH9RTmPAgU5BRO0qc3AF9Ygn5
w3PXSwy4kz4HCvEv1xMCizMrJ45fQnGmGWBo5+f7zTqUweGXJlNrO2AHDtkyTd4n
pbnBqzkSzy/LW/aIzivyPsszuT7Dt13uVWhttzcqoF6+yz/eEHHd/9GbQfZ9Eblp
CMfIBSNdmeXGyxk3vlppUbiWKXOtlNc6JSgyb3i2GqB35NMgAc0V01ScxK1JbpjI
QlwRNaEGUn8cC8b1DShdTIEbzZLKIyR6V5PGqUyuNp3seCD/LuIq5MtmRQFOE4qk
gveVNkLLOC+mwrT8QCkod1nJs7BICMkeqIItm0aoLzi4c1kr42tk3Pq+hIkcyekh
mIuQw2VnNjn1NP530J9/NEPV22tPueM/ifM2uqeRMaZA8RREoGC9ipq7CNURiIgh
/YcVbaTVOp0bAU2VBq3PlSG0ueeN8ZqCJQlVhXaGqwKdHqZOxn6jRWqi+cFz74ZN
o6EqbeHHVG4=
=hFJF
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXN4dk2aOgq3Tt24GAQhjIw//UIHtKWeh9U9iy5cCdaNoY4sqZBYPkkMK
ng2US8YxdyuF/FnTt8VYSExR4Rfzvorp4g7k+hxHOns1LAXfvvnGEPJUvtr0WIgx
cO2O8YGDVIP12VDvuD7YB0sf6v5CnITUOjl1xupz80qIMXC7gD9aBBMhFnT45lM7
4Utao3jYS63PEkPf26w09qk5+igeYTGbg/TvbubiV2gg5S4VZx9+5vAGIrSYg5tp
ye55SevwFt4B/Dg8jhuWFW8iX8hu4JD1yblc9KO9U9+AY1syFSWhckxpJdu0TPUl
En31AxdbpXRrWwW5qgfXtRPcKvwOLm/qoS1kxVayryEMFa4FZerotSaBUcLlyH6x
S0XJ0QxuuZpNOQI3QYkfvCaaAw2bZbvsZfR/CAZffqhTi7+qCII8JprGUikOhGjT
dFRSMGAbnvJcdVhBrDwsTO9o1KZJfuq2PocI/Be+BjFFgGXtJay5VLIKQ1qjTVri
9Qfnlm/ni2epRKg9TpOGiIaXkor/LbXcHT+MDBTy+bays1lejtRlhecQGjTfiYGZ
NoSdCoLqUEE6MUi/dollS+R5HioyVZdYuROM82fv99WHhFr0zSaimec2zSEI7j5u
RwhJIKOR6IDBJcsmdHv+Fzd2jhT7Ac9Hs3ODV0W6bFA9uN0iRG74aMD7FLy1gE7F
c35L1bDDrPA=
=fQsm
-----END PGP SIGNATURE-----