CVE-2019-8341: Code Injection
DISPUTED An issue was discovered in Jinja2 2.10. The fromstring function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing.
Other sources
An issue was discovered in Jinja2 2.10. The fromstring function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI.
Reference: https://github.com/JameelNabbo/Jinja2-Code-execution
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8341?
The severity of CVE-2019-8341 is classified as important due to its potential for Server Side Template Injection (SSTI).
How do I fix CVE-2019-8341?
To fix CVE-2019-8341, update Jinja2 to version 2.10.1 or later, which addresses the Server Side Template Injection vulnerability.
What software is affected by CVE-2019-8341?
CVE-2019-8341 affects Jinja2 version 2.10 and certain versions of openSUSE Leap, specifically 15.0 and 42.3.
What kind of attack can CVE-2019-8341 facilitate?
CVE-2019-8341 allows attackers to perform Server Side Template Injection, enabling them to execute arbitrary commands by injecting template commands.
Is CVE-2019-8341 a widely recognized vulnerability?
Yes, CVE-2019-8341 is a recognized vulnerability that has been reported and discussed within the cybersecurity community.