Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Aikido] Fix security issue in jinja2 via minor version upgrade from 3.1.4 to 3.1.5 #287

Conversation

aikido-autofix[bot]
Copy link

@aikido-autofix aikido-autofix bot commented Jan 8, 2025

This PR will resolve the following CVEs:

CVE ID Severity Description
CVE-2024-56201
HIGH
Jinja is an extensible templating engine. Prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control bo...
CVE-2024-56326
HIGH
Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the conten...
AIKIDO-2024-10560
MEDIUM
Affected versions of this package are affected by Code Injection due to a bypass in Jinja's sandbox validation that restricts direct calls to str.format possible by storing a reference to the format method of a malicious string and invoking it indirectly through a filter. This flaw allows an attac...

@bitterpanda63 bitterpanda63 marked this pull request as draft January 22, 2025 09:14
@bitterpanda63 bitterpanda63 changed the base branch from main to AIK-4292 January 22, 2025 14:39
@bitterpanda63 bitterpanda63 marked this pull request as ready for review January 22, 2025 14:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant