Incorrect Regular Expression in Jinja - CVE-2020-28493

Vulnerability identifier: #VU50430

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28493

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect subpattern applied to untrusted input. A remote attacker can pass specially crafted data to the application and perform a regular expression DoS (ReDOS) attack.

Jinja
Arch Linux
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Ubuntu
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Python2
openEuler
Fedora
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
Ansible Automation Platform
IBM Spectrum Protect Plus
Qradar Advisor
Juniper Cloud Native Router
python-jinja2 (Ubuntu package)
python3-jinja2 (Ubuntu package)
python-jinja2 (Red Hat package)
python3-Jinja2
python2-Jinja2
python-jinja2
python3-jinja2
python-jinja2-help
python2-jinja2
mingw-python-jinja2
IBM Security QRadar Network Threat Analytics
QRadar Assistant
Junos cRPD

Install updates from vendor's website.

Jinja - update to 2.11.3
Migration Toolkit for Containers - update to 1.7.4
Cloud Pak for Security (CP4S) - update to 1.10.7.0
IBM Qradar SIEM - update to 7.5.0 Update Pack 8
IBM Spectrum Protect Plus - update to 10.1.17.1
python-jinja2 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.10.1-2ubuntu0.2
python3-jinja2 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.10.1-2ubuntu0.2, 3.0.3-1ubuntu0.1, 3.1.2-1ubuntu0.23.10.1
IBM Security QRadar Network Threat Analytics - update to 1.1.0
Qradar Advisor - update to 2.6.2
python-jinja2 (Red Hat package) - update to 2.10.1-3.el8
python3-Jinja2 - update to 2.10.1-3.10.2
python2-Jinja2 - update to 2.10.1-3.10.2
python-jinja2 - update to 2.11.2-2
python3-jinja2 - update to 2.11.2-2
python-jinja2-help - update to 2.11.2-2
python2-jinja2 - update to 2.11.2-2
mingw-python-jinja2 - update to 2.11.3-1.fc33
QRadar Assistant - update to 3.7.0
Red Hat OpenShift Container Platform - update to 4.11.0
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1

• https://github.com/pallets/jinja/blob/ab81fd9c277900c85da0c322a2ff9d68a235b2e6/src/jinja2/utils.py%23L20
• https://github.com/pallets/jinja/pull/1343
• https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994

• Denial of service in Pallets Jinja
• Arch Linux update for python2-jinja
• Arch Linux update for python-jinja
• Gentoo update for Jinja
• SUSE update for python-Jinja2
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in IBM QRadar Advisor
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC) 1.7
• Denial of service in IBM Security QRadar Network Threat Analytics
• Ubuntu update for jinja2
• Red Hat Enterprise Linux 8 update for python-jinja2
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4
• Ubuntu update for jinja2
• openEuler 20.03 LTS SP1 update for python-jinja2
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD
• Multiple vulnerabilities in IBM QRadar Assistant
• Red Hat Enterprise Linux 8 update for the python27:2.7 module
• Red Hat Enterprise Linux 8 update for the python38:3.8 and python38-devel:3.8 modules
• Fedora 33 update for mingw-python-jinja2
• Multiple vulnerabilities in IBM Spectrum Protect Plus