Security features bypass in Jinja - CVE-2024-56201

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU101971

Security features bypass in Jinja - CVE-2024-56201

Published: December 27, 2024 / Updated: February 11, 2025


Vulnerability identifier: #VU101971
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-56201
CWE-ID: CWE-254
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to bypass sandbox restrictions.

The vulnerability exists due to improper validation of user-supplied input.  A local user with the ability to control both the filename and the contents of a template can bypass sandbox restrictions.


Affected software

Jinja
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Desktop 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Red Hat Enterprise Linux for x86_64
Anolis OS
Fedora
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Ubuntu
Public Cloud Module
Python 3 Module
openSUSE Leap
openEuler
IBM Cloud Pak for Data System
IBM Concert Software
IBM Cloud Pak for Security
IBM Fusion HCI
IBM Watson Knowledge Catalog in Cloud Pak for Data
Red Hat Satellite
IBM Automation Decision Services
IBM Cloud Pak for Business Automation
IBM Process Mining
Ansible Automation Platform
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Maximo Application Suite
IBM InfoSphere Information Server for Cloud
App Connect Enterprise Certified Container
QRadar Suite
Storage Defender - Resiliency Service
Guardium Data Security Center (GDSC)
Security QRadar EDR
Knowledge Catalog Premium Cartridge
watsonx Code Assistant for Ansible
Maximo Application Suite - Edge Data Collector
Maximo Application Suite - Predict Component
Truststore Manager
Telco Service Design Configuration Designer
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
SOAR QRadar Plugin App
Telco Network Function Virtualization Orchestrator
Maximo Application Suite - IoT Component
Nautobot
watsonx.data
IBM Edge Application Manager
IBM Cloud Pak for Multicloud Management
Red Hat OpenShift Container Platform
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python-jinja2 (Ubuntu package)
python3-jinja2 (Ubuntu package)
rust-gix-trace
rust-gix-utils
rust-gix-shallow
rust-gix-bitmap
rust-nucleo-matcher
rust-toml-span
rust-gix-command
rust-gix-chunk
rust-gix-quote
rust-nucleo
rust-gix-hashtable
rust-gix-pathspec
rust-gix-prompt
rust-gix-validate
rust-gix-sec
rust-gix-path
rust-pulldown-cmark0.11
rust-gix-dir
rust-gengo
rust-pulldown-cmark
rust-gix-fs
rust-gix-ignore
rust-gix-config-value
rust-gix-hash
rust-cargo-deny
rust-tame-index
rust-gix-status
rust-gix-submodule
rust-gix-filter
rust-gix-worktree-state
rust-gix-revwalk
rust-gix-negotiate
rust-gix-glob
rust-cargo_metadata0.18
rust-gix-packetline-blocking
rust-gix-packetline
rust-gix-worktree-stream
rust-gix-archive
rust-cargo_metadata
rust-gix-attributes
rust-gix-mailmap
rust-gix-commitgraph
rust-gix-credentials
rust-gix-refspec
rust-gix-url
rust-rustsec
rust-gix-revision
rust-gix-actor
rust-gix-discover
rust-gix-index
rust-gix-worktree
rust-gix-features
rust-gix-config
rust-gix-traverse
rust-gix-transport
rust-gix-object
rust-gix-protocol
rust-gix-ref
rust-gix-diff
rust-gix-pack
rust-gix-odb
rust-gix
rust-cargo
rust-unicode-general-category
automation-eda-controller (Red Hat package)
rubygem-graphql (Red Hat package)
crun (Red Hat package)
cri-o (Red Hat package)
rust-tokio
rubygem-rack (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
rust-tokio-macros
stgit
python-jinja2
python-jinja2-help
python2-jinja2
python3-jinja2
rust-onefetch
rust-onefetch-ascii
rust-onefetch-image
rust-onefetch-manifest
rust-dua-cli
python311-Jinja2
python39-jinja2-epel
python3x-jinja2 (Red Hat package)
python3.11-jinja2 (Red Hat package)
python-jinja2 (Red Hat package)
mingw-python-jinja2
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
python3.11-pulpcore (Red Hat package)
python3.11-django (Red Hat package)
automation-controller (Red Hat package)
podman (Red Hat package)
fence-agents (Red Hat package)
fence-agents-cisco-mds
fence-agents-hpblade
fence-agents-heuristics-ping
fence-agents-eps
fence-agents-emerson
fence-agents-eaton-snmp
fence-agents-drac5
fence-agents-common
fence-agents-cisco-ucs
ha-cloud-support
fence-agents-brocade
fence-agents-bladecenter
fence-agents-apc-snmp
fence-agents-apc
fence-agents-amt-ws
fence-virtd-cpg
fence-agents-ibm-powervs
fence-agents-ibm-vpc
fence-agents-ibmblade
fence-agents-ifmib
fence-agents-ilo-moonshot
fence-agents-ilo-mp
fence-agents-ilo-ssh
fence-agents-ilo2
fence-agents-intelmodular
fence-agents-ipdu
fence-agents-ipmilan
fence-agents-lpar
fence-agents-mpath
fence-agents-rhevm
fence-agents-rsa
fence-agents-rsb
fence-virtd-serial
fence-agents-wti
fence-agents-vmware-soap
fence-agents-vmware-rest
fence-agents-virsh
fence-agents-scsi
fence-agents-sbd
fence-agents-all
fence-agents-kdump
fence-agents-kubevirt
fence-agents-redfish
fence-agents-aws
fence-virtd-tcp
fence-virtd-multicast
fence-virtd-libvirt
fence-virtd
fence-virt
fence-agents-gce
fence-agents-azure-arm
fence-agents-aliyun
openshift-kuryr (Red Hat package)
satellite (Red Hat package)
rust-vergen
rubygem-foreman_rh_cloud (Red Hat package)
rust-cargo-lock
rust-tokei12
rust-tokei
rust-gix-tempfile
rust-gix-lock
helix
Planning Analytics Local
IBM InfoSphere Information Server

How to mitigate CVE-2024-56201

Install updates from vendor's website.

Jinja - update to 3.1.5
IBM Cloud Pak for Data System - update to 1.0.9.0
IBM Concert Software - update to 2.0.0
IBM Cloud Pak for Security - update to 1.11.3.0
QRadar Suite - update to 1.11.3.0
Storage Defender - Resiliency Service - update to 2.0.11
Nautobot - update to 2.3.15
IBM Fusion HCI - update to 2.10.0
watsonx.data - update to 2.3.1
Guardium Data Security Center (GDSC) - update to 3.8.5
Security QRadar EDR - update to 3.12.15
IBM Watson Knowledge Catalog in Cloud Pak for Data - addressed in versions 4.8.8, 4.8.9, 5.1.3
Knowledge Catalog Premium Cartridge - update to 5.2
watsonx Code Assistant for Ansible - update to 5.1.1
Red Hat Satellite - update to 6.15.5.2
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.14, 9.0.6, 9.1.0
Maximo Application Suite - Predict Component - update to 9.0.4
IBM Automation Decision Services - update to 24.0.0.0.4
IBM Cloud Pak for Business Automation - addressed in versions 24.0.0-IF008, 24.0.1-IF006, 25.0.0-IF004
python-jinja2 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), python3-jinja2, 2.10.1-2ubuntu0.4, 2.10.1-2ubuntu0.5, 2.10.1-2ubuntu0.6
python3-jinja2 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.10.1-2ubuntu0.4, 2.10.1-2ubuntu0.5, 2.10.1-2ubuntu0.6, 3.0.3-1ubuntu0.3, 3.0.3-1ubuntu0.4, 3.1.2-1ubuntu1.2, 3.1.2-1ubuntu1.3, 3.1.3-1ubuntu1.24.10.1, 3.1.3-1ubuntu1.24.10.2
rust-gix-trace - update to 0.1.12-1.fc42
rust-gix-utils - update to 0.1.14-1.fc42
rust-gix-shallow - update to 0.2.0-1.fc42
rust-gix-bitmap - update to 0.2.14-1.fc42
rust-nucleo-matcher - update to 0.3.1-1.fc42
rust-toml-span - update to 0.4.1-1.fc42
rust-gix-command - update to 0.4.1-1.fc42
rust-gix-chunk - update to 0.4.11-1.fc42
rust-gix-quote - update to 0.4.15-1.fc42
rust-nucleo - update to 0.5.0-1.fc42
rust-gix-hashtable - update to 0.7.0-1.fc42
rust-gix-pathspec - update to 0.9.0-1.fc42
rust-gix-prompt - update to 0.9.1-1.fc42
rust-gix-validate - update to 0.9.3-1.fc42
rust-gix-sec - update to 0.10.11-1.fc42
rust-gix-path - update to 0.10.14-1.fc42
rust-pulldown-cmark0.11 - update to 0.11.3-1.fc42
rust-gix-dir - update to 0.12.0-1.fc42
rust-gengo - update to 0.12.1-1.fc42
rust-pulldown-cmark - update to 0.12.2-1.fc42
rust-gix-fs - update to 0.13.0-1.fc42
rust-gix-ignore - update to 0.13.0-1.fc42
rust-gix-config-value - update to 0.14.11-1.fc42
rust-gix-hash - update to 0.16.0-1.fc42
rust-cargo-deny - update to 0.16.4-1.fc42
rust-tame-index - update to 0.17.0-1.fc42
rust-gix-status - update to 0.17.0-1.fc42
rust-gix-submodule - update to 0.17.0-1.fc42
rust-gix-filter - update to 0.17.0-1.fc42
rust-gix-worktree-state - update to 0.17.0-1.fc42
rust-gix-revwalk - update to 0.18.0-1.fc42
rust-gix-negotiate - update to 0.18.0-1.fc42
rust-gix-glob - update to 0.18.0-1.fc42
rust-cargo_metadata0.18 - update to 0.18.1-1.fc42
rust-gix-packetline-blocking - update to 0.18.2-1.fc42
rust-gix-packetline - update to 0.18.3-1.fc42
rust-gix-worktree-stream - update to 0.19.0-1.fc42
rust-gix-archive - update to 0.19.0-1.fc42
rust-cargo_metadata - update to 0.19.1-1.fc42
rust-gix-attributes - update to 0.24.0-1.fc42
rust-gix-mailmap - update to 0.25.2-1.fc42
rust-gix-commitgraph - update to 0.26.0-1.fc42
rust-gix-credentials - update to 0.27.0-1.fc42
rust-gix-refspec - update to 0.28.0-1.fc42
rust-gix-url - update to 0.29.0-1.fc42
rust-rustsec - update to 0.30.1-1.fc42
rust-gix-revision - update to 0.32.0-1.fc42
rust-gix-actor - update to 0.33.2-1.fc42
rust-gix-discover - update to 0.38.0-1.fc42
rust-gix-index - update to 0.38.0-1.fc42
rust-gix-worktree - update to 0.39.0-1.fc42
rust-gix-features - update to 0.40.0-1.fc42
rust-gix-config - update to 0.43.0-1.fc42
rust-gix-traverse - update to 0.44.0-1.fc42
rust-gix-transport - update to 0.45.0-1.fc42
rust-gix-object - update to 0.47.0-1.fc42
rust-gix-protocol - update to 0.48.0-1.fc42
rust-gix-ref - update to 0.50.0-1.fc42
rust-gix-diff - update to 0.50.0-1.fc42
rust-gix-pack - update to 0.57.0-1.fc42
rust-gix-odb - update to 0.67.0-1.fc42
rust-gix - update to 0.70.0-1.fc42
rust-cargo - update to 0.79.0-8.fc42
rust-unicode-general-category - update to 1.0.0-1.fc42
automation-eda-controller (Red Hat package) - addressed in versions 1.1.4-1.el8ap, 1.1.4-1.el9ap
Truststore Manager - update to 1.6.2
rubygem-graphql (Red Hat package) - update to 1.13.24-1.el8sat
crun (Red Hat package) - addressed in versions 1.17-2.rhaos4.14.el8, 1.17-2.rhaos4.14.el9, 1.17-2.rhaos4.15.el8, 1.17-2.rhaos4.15.el9, 1.17-2.rhaos4.16.el8, 1.17-2.rhaos4.16.el9
cri-o (Red Hat package) - addressed in versions 1.29.12-4.rhaos4.16.gitadc9401.el8, 1.29.12-4.rhaos4.16.gitadc9401.el9, 1.30.9-3.rhaos4.17.gitbbf9018.el8, 1.30.9-3.rhaos4.17.gitbbf9018.el9
rust-tokio - update to 1.43.0-1.fc42
IBM Process Mining - update to 2.0.0 IF001
Planning Analytics Local - addressed in versions 2.0.0.101, 2.1.8
rubygem-rack (Red Hat package) - update to 2.2.13-1.el8sat
Telco Service Design Configuration Designer - update to 2.3.0
IBM Cloud Pak for Multicloud Management - update to 2.3 FP11
Ansible Automation Platform - addressed in versions 2.4, 2.5
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-9.el8ap, 2.4-9.el9ap, 2.5-8.el8ap, 2.5-8.el9ap
rust-tokio-macros - update to 2.5.0-1.fc42
stgit - update to 2.5.1-1.fc42
python-jinja2 - addressed in versions 2.11.2-9, 3.0.3-6, 3.1.3-4
python-jinja2-help - addressed in versions 2.11.2-9, 3.0.3-6, 3.1.3-4
python2-jinja2 - update to 2.11.2-9
python3-jinja2 - addressed in versions 2.11.2-9, 3.0.3-6, 3.1.3-4
rust-onefetch - update to 2.23.1-1.fc42
rust-onefetch-ascii - update to 2.23.1-1.fc42
rust-onefetch-image - update to 2.23.1-1.fc42
rust-onefetch-manifest - update to 2.23.1-1.fc42
rust-dua-cli - update to 2.29.2-3.fc42
python311-Jinja2 - update to 3.1.2-150400.12.11.1
python39-jinja2-epel - update to 3.1.3-1.3.el8
python3x-jinja2 (Red Hat package) - update to 3.1.5-1.el8ap
python3.11-jinja2 (Red Hat package) - addressed in versions 3.1.5-1.el8ap, 3.1.5-1.el9ap
python-jinja2 (Red Hat package) - addressed in versions 3.1.5-1.el9ap, 3.1.5-1.el8pc
python-jinja2 - addressed in versions 3.1.5-1.fc40, 3.1.5-1.fc41
mingw-python-jinja2 - addressed in versions 3.1.5-1.fc40, 3.1.5-1.fc41
python3x-pulpcore (Red Hat package) - update to 3.28.36-1.el8ap
python-pulpcore (Red Hat package) - addressed in versions 3.28.36-1.el9ap, 3.39.25-1.el8pc
python3.11-pulpcore (Red Hat package) - addressed in versions 3.49.30-1.el8ap, 3.49.30-1.el9ap
python3.11-django (Red Hat package) - addressed in versions 4.2.18-1.el8ap, 4.2.18-1.el9ap
automation-controller (Red Hat package) - addressed in versions 4.5.17-1.el8ap, 4.5.17-1.el9ap, 4.6.7-1.el8ap, 4.6.7-1.el9ap
podman (Red Hat package) - addressed in versions 4.9.4-13.rhaos4.16.el8, 4.9.4-15.rhaos4.16.el9
fence-agents (Red Hat package) - addressed in versions 4.10.0-20.el9_0.20, 4.10.0-43.el9_2.11, 4.10.0-62.el9_4.10, 4.10.0-76.el9_5.4
fence-agents-cisco-mds - update to 4.10.0-76.0.1
fence-agents-hpblade - update to 4.10.0-76.0.1
fence-agents-heuristics-ping - update to 4.10.0-76.0.1
fence-agents-eps - update to 4.10.0-76.0.1
fence-agents-emerson - update to 4.10.0-76.0.1
fence-agents-eaton-snmp - update to 4.10.0-76.0.1
fence-agents-drac5 - update to 4.10.0-76.0.1
fence-agents-common - update to 4.10.0-76.0.1
fence-agents-cisco-ucs - update to 4.10.0-76.0.1
ha-cloud-support - update to 4.10.0-76.0.1
fence-agents-brocade - update to 4.10.0-76.0.1
fence-agents-bladecenter - update to 4.10.0-76.0.1
fence-agents-apc-snmp - update to 4.10.0-76.0.1
fence-agents-apc - update to 4.10.0-76.0.1
fence-agents-amt-ws - update to 4.10.0-76.0.1
fence-virtd-cpg - update to 4.10.0-76.0.1
fence-agents-ibm-powervs - update to 4.10.0-76.0.1
fence-agents-ibm-vpc - update to 4.10.0-76.0.1
fence-agents-ibmblade - update to 4.10.0-76.0.1
fence-agents-ifmib - update to 4.10.0-76.0.1
fence-agents-ilo-moonshot - update to 4.10.0-76.0.1
fence-agents-ilo-mp - update to 4.10.0-76.0.1
fence-agents-ilo-ssh - update to 4.10.0-76.0.1
fence-agents-ilo2 - update to 4.10.0-76.0.1
fence-agents-intelmodular - update to 4.10.0-76.0.1
fence-agents-ipdu - update to 4.10.0-76.0.1
fence-agents-ipmilan - update to 4.10.0-76.0.1
fence-agents-lpar - update to 4.10.0-76.0.1
fence-agents-mpath - update to 4.10.0-76.0.1
fence-agents-rhevm - update to 4.10.0-76.0.1
fence-agents-rsa - update to 4.10.0-76.0.1
fence-agents-rsb - update to 4.10.0-76.0.1
fence-virtd-serial - update to 4.10.0-76.0.1
fence-agents-wti - update to 4.10.0-76.0.1
fence-agents-vmware-soap - update to 4.10.0-76.0.1
fence-agents-vmware-rest - update to 4.10.0-76.0.1
fence-agents-virsh - update to 4.10.0-76.0.1
fence-agents-scsi - update to 4.10.0-76.0.1
fence-agents-sbd - update to 4.10.0-76.0.1
fence-agents-all - update to 4.10.0-76.0.1
fence-agents-kdump - update to 4.10.0-76.0.1
fence-agents-kubevirt - update to 4.10.0-76.0.1
fence-agents-redfish - update to 4.10.0-76.0.1
fence-agents-aws - update to 4.10.0-76.0.1
fence-virtd-tcp - update to 4.10.0-76.0.1
fence-virtd-multicast - update to 4.10.0-76.0.1
fence-virtd-libvirt - update to 4.10.0-76.0.1
fence-virtd - update to 4.10.0-76.0.1
fence-virt - update to 4.10.0-76.0.1
fence-agents-gce - update to 4.10.0-76.0.1
fence-agents-azure-arm - update to 4.10.0-76.0.1
fence-agents-aliyun - update to 4.10.0-76.0.1
openshift-kuryr (Red Hat package) - addressed in versions 4.12.0-202501071748.p0.g8fd2f8b.assembly.stream.el8, 4.13.0-202501071752.p0.g36754b7.assembly.stream.el8
Red Hat OpenShift Container Platform - addressed in versions 4.12.72, 4.13.55, 4.14.46, 4.15.45, 4.16.33, 4.16.34, 4.17.14, 4.17.15
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.1.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.3
watsonx Assistant Cartridge - update to 5.1.3
SOAR QRadar Plugin App - update to 5.6.0
satellite (Red Hat package) - update to 6.15.5.2-1.el8sat
Telco Network Function Virtualization Orchestrator - update to 7.3.0
rust-vergen - update to 8.3.2-3.fc42
Maximo Application Suite - IoT Component - addressed in versions 8.7.19, 8.8.15, 9.0.5
IBM Maximo Application Suite - addressed in versions 8.10.22, 8.11.19, 9.0.8
rubygem-foreman_rh_cloud (Red Hat package) - update to 9.0.60-1.el8sat
rust-cargo-lock - update to 10.1.0-1.fc42
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 6
IBM InfoSphere Information Server for Cloud - update to 11.7.1 Fix Pack 6
rust-tokei12 - update to 12.1.2-19.fc42
App Connect Enterprise Certified Container - update to 12.8.0
rust-tokei - update to 13.0.0~alpha.8-19.fc42
rust-gix-tempfile - update to 16.0.0-1.fc42
rust-gix-lock - update to 16.0.0-1.fc42
helix - update to 25.01.1-1.fc42

External References

Related Security Bulletins