p PatchFirst

CVE-2020-28493

CVE-2020-28493 · Regular Expression Denial of Service (ReDoS)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

CVSS 5.3 · Medium · EPSS 3.6% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • jinja2

    Versions
    • ≥ 0.0.0, < unspecified: Affected (custom)
    • ≥ unspecified, < 2.11.3: Affected (custom)

    Update to 2.11.3

  • jinja2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.11.3-1

    Update to 2.11.3-1

  • jinja2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.11.3-1

    Update to 2.11.3-1

  • jinja2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.11.3-1

    Update to 2.11.3-1

  • jinja2 PyPI

    Versions
    • 2.0
    • 2.0rc1
    • 2.1
    • 2.1.1
    • 2.10
    • 2.10.1
    • 2.10.2
    • 2.10.3
    • 2.11.0
    • 2.11.1
    • 2.11.2
    • 2.2
    • 2.2.1
    • 2.3
    • 2.3.1
    • 2.4
    • 2.4.1
    • 2.5
    • 2.5.1
    • 2.5.2
    • 2.5.3
    • 2.5.4
    • 2.5.5
    • 2.6
    • 2.7
    • 2.7.1
    • 2.7.2
    • 2.7.3
    • 2.8
    • 2.8.1
    • 2.9
    • 2.9.1
    • 2.9.2
    • 2.9.3
    • 2.9.4
    • 2.9.5
    • 2.9.6
    Affected ranges
    • ECOSYSTEM: < 2.11.3

    Update to 2.11.3

  • jinja2 PyPI

    Versions
    • 2.0rc1
    • 2.0
    • 2.1
    • 2.1.1
    • 2.2
    • 2.2.1
    • 2.3
    • 2.3.1
    • 2.4
    • 2.4.1
    • 2.5
    • 2.5.1
    • 2.5.2
    • 2.5.3
    • 2.5.4
    • 2.5.5
    • 2.6
    • 2.7
    • 2.7.1
    • 2.7.2
    • 2.7.3
    • 2.8
    • 2.8.1
    • 2.9
    • 2.9.1
    • 2.9.2
    • 2.9.3
    • 2.9.4
    • 2.9.5
    • 2.9.6
    • 2.10
    • 2.10.1
    • 2.10.2
    • 2.10.3
    • 2.11.0
    • 2.11.1
    • 2.11.2
    Affected ranges
    • ECOSYSTEM: < 2.11.3

    Update to 2.11.3

  • jinja2 Ubuntu:Pro:14.04:LTS

    Versions
    • 2.7-3
    • 2.7.1-1
    • 2.7.2-1
    • 2.7.2-2
    • 2.7.2-2ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: < 2.7.2-2ubuntu0.1~esm2

    Update to 2.7.2-2ubuntu0.1~esm2

  • jinja2 Ubuntu:Pro:16.04:LTS

    Versions
    • 2.8-1
    • 2.8-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 2.8-1ubuntu0.1+esm1

    Update to 2.8-1ubuntu0.1+esm1

  • jinja2 Ubuntu:Pro:18.04:LTS

    Versions
    • 2.9.6-1
    • 2.10-1
    • 2.10-1ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: < 2.10-1ubuntu0.18.04.1+esm1

    Update to 2.10-1ubuntu0.18.04.1+esm1

  • jinja2 Ubuntu:20.04:LTS

    Versions
    • 2.10-2ubuntu1
    • 2.10-2ubuntu2
    • 2.10.1-1ubuntu1
    • 2.10.1-2
    Affected ranges
    • ECOSYSTEM: < 2.10.1-2ubuntu0.2

    Update to 2.10.1-2ubuntu0.2

Original sources

Check your server →