VulnerabilityModified
CVE-2020-28493
The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards.
MEDIUM 5.3EPSS 3.55%
Does this matter?
Lower severity and a low EPSS score (3.55%). Track it; it rarely justifies an emergency change on its own.
Description
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 3.55% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- palletsprojects/jinja · fedoraproject/fedora
- Source
- report@snyk.io
References
- https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20Broken Link
- https://github.com/pallets/jinja/pull/1343Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/
- https://security.gentoo.org/glsa/202107-19Third Party Advisory
- https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994Exploit, Third Party Advisory
- https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20Broken Link
- https://github.com/pallets/jinja/pull/1343Patch, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PVAKCOO7VBVUBM3Q6CBBTPBFNP5NDXF4/
- https://security.gentoo.org/glsa/202107-19Third Party Advisory
- https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.