Bugzilla – Bug 1218722
VUL-0: CVE-2024-22195: python-Jinja2: HTML attribute injection when passing user input as keys to xmlattr filter
Last modified: 2024-07-12 16:30:54 UTC
Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22195 https://github.com/pallets/jinja/commit/716795349a41d4983a9a4771f7d883c96ea17be7 https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95 https://www.cve.org/CVERecord?id=CVE-2024-22195 https://github.com/pallets/jinja/releases/tag/3.1.3
Affected: - SUSE:ALP:Source:Standard:1.0 - SUSE:SLE-12-SP3:Update:Products:Cloud8:Update (wontfix due to CVSS to low) - SUSE:SLE-12-SP4:Update:Products:Cloud9:Update (wontfix due to CVSS to low) - SUSE:SLE-12:Update - SUSE:SLE-12:Update:Products:ManagerToolsBeta:Update - SUSE:SLE-15-SP4:Update - SUSE:SLE-15:Update
This is an autogenerated message for OBS integration: This bug (1218722) was mentioned in https://build.opensuse.org/request/show/1138254 Factory / python-Jinja2
SOC products are under LTSS, it means that only CVE's with a cvss higher than 7 are to be considered, which is not the case for this CVE. No actions from Cloud-bugs side. BAck to Security team.
Hi Stoyan, Good question! :-) Cloud-bugs was maintaining only SLE-12-SP3 and SLE-12-SP4 code streams. @robert.simai @jeremy.moffitt could you please comment here?
Not sure what the options are, but I believe cloud-bugs is only associated with python-Jinja2 due to its use in SOC. It's not really a "cloud" software package and is more of a generic web template package. I believe it was included in SOC for use with ansible and we relied on it heavily in the Ardana configuration processor.
SUSE-SU-2024:1863-2: An update that solves two vulnerabilities can now be installed. Category: security (moderate) Bug References: 1218722, 1223980 CVE References: CVE-2024-22195, CVE-2024-34064 Maintenance Incident: [SUSE:Maintenance:33877](https://smelt.suse.de/incident/33877/) Sources used: SUSE Linux Enterprise Micro 5.5 (src): python-Jinja2-2.10.1-150000.3.13.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.