CVE:CVE-2019-10906
CNNVD:CNNVD-201904-294
Pallets Jinja是一款使用Python语言编写的模板引擎。
Pallets Jinja 2.10.1之前版本中存在权限许可和访问控制问题漏洞。攻击者可利用该漏洞绕过沙盒保护。
solution:Upgrade palletsprojects jinja to a higher version than 2.10.1,and avoid the version (,2.10.1); Upgrade fedoraproject fedora to a higher version than 28,29,30,and avoid the version 28,29,30; Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,16.04,18.04,18.10,19.04,and avoid the version 12.04,14.04,16.04,18.04,18.10,19.04; Upgrade redhat software_collections to a higher version than 1.0,and avoid the version 1.0; Upgrade opensuse leap to a higher version than 15.0,42.3,and avoid the version 15.0,42.3