Cross-site scripting in Jinja - CVE-2024-34064

Vulnerability identifier: #VU89677

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2024-34064

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within the "xmlattr" filter. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Jinja
Oracle Linux
Amazon Linux AMI
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Micro
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Anolis OS
Fedora
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE Manager Client Tools for SLE
Public Cloud Module
Advanced Systems Management Module
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
Ubuntu
openEuler
Oracle Solaris
IBM Cloud Pak for Data System
IBM Concert Software
IBM Process Mining
Oracle Communications Diameter Signaling Router
IBM Spectrum Protect Plus
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Cloud Native Core Network Exposure Function
Oracle Communications Cloud Native Core Network Repository Function
Ansible Automation Platform
Qradar Advisor
QRadar User Behavior Analytics
Red Hat Update Infrastructure (RHUI)
IBM Maximo Application Suite
Storage Defender - Resiliency Service
Oracle Communications Operations Monitor
Oracle Business Intelligence Enterprise Edition
Storage Protect Plus File Systems Agent
Oracle Communications User Data Repository
Truststore Manager
Security QRadar EDR
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
SOAR QRadar Plugin App
Maximo Application Suite - Edge Data Collector
Maximo Application Suite - Monitor Component
watsonx.data
Traffix SDC
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Communications Unified Assurance
Oracle Financial Services Compliance Studio
Oracle Banking Corporate Lending Process Management
Oracle Banking Origination
Oracle Banking Liquidity Management
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
python-jinja2 (Ubuntu package)
python3-jinja2 (Ubuntu package)
libcomps (Red Hat package)
aap-metrics-utility (Red Hat package)
python-json-stream-rs-tokenizer (Red Hat package)
python-iniparse (Red Hat package)
python3x-sqlparse (Red Hat package)
python-sqlparse (Red Hat package)
python-gnupg (Red Hat package)
python-inflection (Red Hat package)
python-defusedxml (Red Hat package)
python-ecdsa (Red Hat package)
python-pyrsistent (Red Hat package)
python-future (Red Hat package)
python3x-pulp-ansible (Red Hat package)
python-pulp-ansible (Red Hat package)
python-drf-spectacular (Red Hat package)
python-pulp-glue (Red Hat package)
m2crypto (Red Hat package)
python-drf-nested-routers (Red Hat package)
python-django-lifecycle (Red Hat package)
python-djangorestframework-queryfields (Red Hat package)
python-asyncio-throttle (Red Hat package)
ansible-rulebook (Red Hat package)
automation-eda-controller (Red Hat package)
python-brotli (Red Hat package)
python-et-xmlfile (Red Hat package)
python-django-readonly-field (Red Hat package)
createrepo_c (Red Hat package)
runc (Red Hat package)
python-deprecated (Red Hat package)
python-drf-access-policy (Red Hat package)
python-xlwt (Red Hat package)
python-aiosignal (Red Hat package)
python-frozenlist (Red Hat package)
python-odfpy (Red Hat package)
python-pyjwkest (Red Hat package)
python-url-normalize (Red Hat package)
receptor (Red Hat package)
python-aiohttp-xmlrpc (Red Hat package)
python-jq (Red Hat package)
python-yarl (Red Hat package)
python3x-pydantic (Red Hat package)
python-pydantic (Red Hat package)
python-wrapt (Red Hat package)
python-markuppy (Red Hat package)
python-rhsm (Red Hat package)
cri-o (Red Hat package)
python-productmd (Red Hat package)
python-googleapis-common-protos (Red Hat package)
python-grpcio (Red Hat package)
rhui-cds-plugin-mirror (Red Hat package)
rhui-cds-plugin-fetcher (Red Hat package)
rhui-cds-plugin-authorizer-cert (Red Hat package)
rhui-cds-plugin-authorizer (Red Hat package)
python-urlman (Red Hat package)
python-xlrd (Red Hat package)
python-charset-normalizer (Red Hat package)
python-markupsafe (Red Hat package)
python-backoff (Red Hat package)
python-urllib3 (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
python-pyjwt (Red Hat package)
python-pygtrie (Red Hat package)
python-dateutil (Red Hat package)
python-Jinja2
python3-Jinja2
python3-jinja2-doc
python3-jinja2
python-jinja2 (Red Hat package)
python-jinja2
python2-jinja2
python-jinja2-help
ansible-core (Red Hat package)
python-pulp-container (Red Hat package)
python-pulp-container-client (Red Hat package)
ansible-collection-community-crypto (Red Hat package)
python-pycparser (Red Hat package)
python3x-requests (Red Hat package)
python-requests (Red Hat package)
python-aiodns (Red Hat package)
python-django-import-export (Red Hat package)
python-openpyxl (Red Hat package)
python-pyparsing (Red Hat package)
python39-jinja2-epel
python3-jinja2+i18n
python3x-jinja2 (Red Hat package)
mingw-python-jinja2
python-dynaconf (Red Hat package)
python-psycopg_c (Red Hat package)
python-psycopg (Red Hat package)
python-django-guid (Red Hat package)
python-tablib (Red Hat package)
python-types-cryptography (Red Hat package)
python-zipp (Red Hat package)
python-asgiref (Red Hat package)
python3x-idna (Red Hat package)
python-idna (Red Hat package)
python-aiohttp (Red Hat package)
python3x-aiohttp (Red Hat package)
python-djangorestframework (Red Hat package)
python-pycryptodomex (Red Hat package)
python-pulp-rpm-client (Red Hat package)
python-pulp-rpm (Red Hat package)
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
python-pulpcore-client (Red Hat package)
python-async-timeout (Red Hat package)
python-uritemplate (Red Hat package)
python-pycares (Red Hat package)
fence-agents (Red Hat package)
python-django (Red Hat package)
python-redis (Red Hat package)
automation-controller (Red Hat package)
python-typing-extensions (Red Hat package)
automation-hub (Red Hat package)
python3x-galaxy-ng (Red Hat package)
python-galaxy-ng (Red Hat package)
fence-agents-vmware-rest
fence-agents-amt-ws
fence-agents-rhevm
fence-agents-rsa
fence-agents-all
ha-cloud-support
fence-agents-rsb
fence-virtd-tcp
fence-virtd-serial
fence-agents-sbd
fence-virtd-multicast
fence-agents-scsi
fence-virtd-libvirt
fence-agents-virsh
fence-agents-eps
fence-agents-vmware-soap
fence-agents-wti
fence-virtd-cpg
fence-virtd
fence-virt
fence-agents-gce
fence-agents-azure-arm
fence-agents-kdump
fence-agents-aws
fence-agents-aliyun
fence-agents-redfish
fence-agents-kubevirt
fence-agents-apc
fence-agents-emerson
fence-agents-eaton-snmp
fence-agents-hpblade
fence-agents-drac5
fence-agents-ibm-powervs
fence-agents-common
fence-agents-ibm-vpc
fence-agents-ibmblade
fence-agents-heuristics-ping
fence-agents-cisco-ucs
fence-agents-ifmib
fence-agents-cisco-mds
fence-agents-ilo-moonshot
fence-agents-mpath
fence-agents-lpar
fence-agents-ipmilan
fence-agents-ipdu
fence-agents-intelmodular
fence-agents-apc-snmp
fence-agents-ilo2
fence-agents-ilo-ssh
fence-agents-ilo-mp
fence-agents-bladecenter
fence-agents-brocade
python-jsonschema (Red Hat package)
rhui-installer (Red Hat package)
rhui-tools (Red Hat package)
python-protobuf (Red Hat package)
python3x-social-auth-app-django (Red Hat package)
python-social-auth-app-django (Red Hat package)
python-pyyaml (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
python-whitenoise (Red Hat package)
python-importlib-metadata (Red Hat package)
python-multidict (Red Hat package)
python-click (Red Hat package)
python3x-pillow (Red Hat package)
python-pillow (Red Hat package)
python-packaging (Red Hat package)
python-attrs (Red Hat package)
python3x-gunicorn (Red Hat package)
python-gunicorn (Red Hat package)
python-aiofiles (Red Hat package)
python3x-black (Red Hat package)
python-black (Red Hat package)
python-django-filter (Red Hat package)
python3x-pyOpenSSL (Red Hat package)
python-pyOpenSSL (Red Hat package)
python3x-cryptography (Red Hat package)
python-cryptography (Red Hat package)
python-pytz (Red Hat package)
python-certifi (Red Hat package)
python-uuid6 (Red Hat package)
python-diff-match-patch (Red Hat package)
Oracle Communications Cloud Native Core Network Function Cloud Native Environment
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Policy
Cloud Pak for Data
IBM Qradar SIEM
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM Storage Scale System

Install updates from vendor's website.

Jinja - update to 3.1.4
IBM Cloud Pak for Data System - update to 1.0.9.0
IBM Concert Software - update to 1.0.5
IBM Process Mining - update to 1.15.0
Storage Defender - Resiliency Service - update to 2.0.5
watsonx.data - update to 2.3.1
Traffix SDC - update to 5.2.0
IBM Spectrum Protect Plus - update to 10.1.17.1
Storage Protect Plus File Systems Agent - update to 10.1.16.2
python-jinja2 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.10.1-2ubuntu0.3
python3-jinja2 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.10.1-2ubuntu0.3, 3.0.3-1ubuntu0.2, 3.1.2-1ubuntu0.23.10.2, 3.1.2-1ubuntu1.1
libcomps (Red Hat package) - update to 0.1.21-1.el8ui
aap-metrics-utility (Red Hat package) - addressed in versions 0.3.0-1.el8ap, 0.3.0-1.el9ap
python-json-stream-rs-tokenizer (Red Hat package) - update to 0.4.25-4.el8ui
python-iniparse (Red Hat package) - update to 0.4-40.0.1.el8ui
python3x-sqlparse (Red Hat package) - update to 0.5.0-1.el8ap
python-sqlparse (Red Hat package) - addressed in versions 0.5.0-1.el9ap, 0.5.0-1.el8ui
python-gnupg (Red Hat package) - update to 0.5.0-5.el8ui
python-inflection (Red Hat package) - update to 0.5.1-7.el8ui
python-defusedxml (Red Hat package) - update to 0.7.1-7.el8ui
python-ecdsa (Red Hat package) - update to 0.18.0-5.el8ui
python-pyrsistent (Red Hat package) - update to 0.18.1-6.el8ui
python-future (Red Hat package) - update to 0.18.3-5.el8ui
python3x-pulp-ansible (Red Hat package) - update to 0.20.7-1.el8ap
python-pulp-ansible (Red Hat package) - update to 0.20.7-1.el9ap
python-drf-spectacular (Red Hat package) - update to 0.26.5-5.el8ui
python-pulp-glue (Red Hat package) - update to 0.29.2-2.el8ui
m2crypto (Red Hat package) - update to 0.40.1-1.0.2.el8ui
python-drf-nested-routers (Red Hat package) - update to 0.93.4-6.el8ui
python-django-lifecycle (Red Hat package) - update to 1.0.0-4.el8ui
python-djangorestframework-queryfields (Red Hat package) - update to 1.0.0-8.el8ui
python-asyncio-throttle (Red Hat package) - update to 1.0.2-7.el8ui
ansible-rulebook (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
automation-eda-controller (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
python-brotli (Red Hat package) - update to 1.0.9-6.el8ui
python-et-xmlfile (Red Hat package) - update to 1.1.0-6.el8ui
python-django-readonly-field (Red Hat package) - update to 1.1.2-4.el8ui
createrepo_c (Red Hat package) - update to 1.1.3-1.0.1.el8ui
runc (Red Hat package) - update to 1.1.13-4.rhaos4.13.el9
python-deprecated (Red Hat package) - update to 1.2.13-5.el8ui
python-drf-access-policy (Red Hat package) - update to 1.3.0-4.el8ui
python-xlwt (Red Hat package) - update to 1.3.0-7.el8ui
python-aiosignal (Red Hat package) - update to 1.3.1-5.el8ui
python-frozenlist (Red Hat package) - update to 1.3.3-5.el8ui
python-odfpy (Red Hat package) - update to 1.4.1-10.el8ui
python-pyjwkest (Red Hat package) - update to 1.4.2-9.el8ui
python-url-normalize (Red Hat package) - update to 1.4.3-8.el8ui
receptor (Red Hat package) - addressed in versions 1.4.8-1.el8ap, 1.4.8-1.el9ap
python-aiohttp-xmlrpc (Red Hat package) - update to 1.5.0-6.el8ui
Truststore Manager - update to 1.6.0
python-jq (Red Hat package) - update to 1.6.0-4.el8ui
python-yarl (Red Hat package) - update to 1.8.2-5.el8ui
Migration Toolkit for Containers - update to 1.8.4
python3x-pydantic (Red Hat package) - update to 1.10.15-1.el8ap
python-pydantic (Red Hat package) - update to 1.10.15-1.el9ap
python-wrapt (Red Hat package) - update to 1.14.1-5.el8ui
python-markuppy (Red Hat package) - update to 1.14-7.el8ui
python-rhsm (Red Hat package) - update to 1.19.2-7.0.1.el8ui
cri-o (Red Hat package) - addressed in versions 1.26.5-21.rhaos4.13.git307b1ea.el8, 1.26.5-21.rhaos4.13.git307b1ea.el9, 1.28.8-3.rhaos4.15.gita511a66.el8
python-productmd (Red Hat package) - update to 1.33-7.el8ui
python-googleapis-common-protos (Red Hat package) - update to 1.59.1-5.el8ui
python-grpcio (Red Hat package) - update to 1.65.4-1.el8ui
rhui-cds-plugin-mirror (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-fetcher (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-authorizer-cert (Red Hat package) - update to 2.0.0-1.el8ui
rhui-cds-plugin-authorizer (Red Hat package) - update to 2.0.0-1.el8ui
python-urlman (Red Hat package) - update to 2.0.1-5.el8ui
python-xlrd (Red Hat package) - update to 2.0.1-9.el8ui
python-charset-normalizer (Red Hat package) - update to 2.1.1-5.el8ui
python-markupsafe (Red Hat package) - update to 2.1.2-5.el8ui
python-backoff (Red Hat package) - update to 2.2.1-5.el8ui
python-urllib3 (Red Hat package) - update to 2.2.3-1.el8ui
Ansible Automation Platform - update to 2.4
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-7.1.el8ap, 2.4-7.1.el9ap
python-pyjwt (Red Hat package) - update to 2.5.0-5.el8ui
python-pygtrie (Red Hat package) - update to 2.5.0-5.el8ui
Qradar Advisor - update to 2.6.6
python-dateutil (Red Hat package) - update to 2.8.2-7.el8ui
python-Jinja2 - update to 2.8-19.26.1
python3-Jinja2 - addressed in versions 2.8-19.26.1, 2.10.1-150000.3.13.1
python3-jinja2-doc - addressed in versions 2.10.1-3.0.3, 3.1.3-3
python3-jinja2 - addressed in versions 2.10.1-3.0.3, 3.1.3-3
python-jinja2 (Red Hat package) - addressed in versions 2.10.1-5.el8_10, 2.11.3-6.el9, 3.1.4-1.el9ap, 3.1.4-1.el8ui
python-jinja2 - update to 2.11.2-7
python2-jinja2 - update to 2.11.2-7
python-jinja2-help - update to 2.11.2-7
python3-jinja2 - update to 2.11.2-7
ansible-core (Red Hat package) - addressed in versions 2.15.11-1.el8ap, 2.15.11-1.el9ap, 2.15.12-1.el8ap, 2.15.12-1.el9ap
python-pulp-container (Red Hat package) - update to 2.20.3-1.el8ui
python-pulp-container-client (Red Hat package) - update to 2.21.0-1.el8ui
ansible-collection-community-crypto (Red Hat package) - update to 2.21.1-1.el8ui
python-pycparser (Red Hat package) - update to 2.21-6.el8ui
python3x-requests (Red Hat package) - update to 2.32.2-1.el8ap
python-requests (Red Hat package) - addressed in versions 2.32.2-1.el9ap, 2.32.3-2.el8ui
python-aiodns (Red Hat package) - update to 3.0.0-7.el8ui
python-django-import-export (Red Hat package) - update to 3.1.0-4.el8ui
python-openpyxl (Red Hat package) - update to 3.1.0-5.el8ui
python-pyparsing (Red Hat package) - update to 3.1.1-4.el8ui
python39-jinja2-epel - update to 3.1.3-1.2.el8
python3-jinja2+i18n - update to 3.1.3-3
python3x-jinja2 (Red Hat package) - update to 3.1.4-1.el8ap
python-jinja2 - addressed in versions 3.1.4-1.fc38, 3.1.4-1.fc39, 3.1.4-1.fc40, 3.1.4-1.fc41
mingw-python-jinja2 - addressed in versions 3.1.4-1.fc39, 3.1.4-1.fc40
python-dynaconf (Red Hat package) - update to 3.1.12-4.el8ui
python-psycopg_c (Red Hat package) - update to 3.2.3-1.el8ui
python-psycopg (Red Hat package) - update to 3.2.3-1.el8ui
python-django-guid (Red Hat package) - update to 3.3.0-5.el8ui
python-tablib (Red Hat package) - update to 3.3.0-5.el8ui
python-types-cryptography (Red Hat package) - update to 3.3.23.2-5.el8ui
python-zipp (Red Hat package) - update to 3.4.0-8.el8ui
python-asgiref (Red Hat package) - update to 3.6.0-5.el8ui
python3x-idna (Red Hat package) - update to 3.7-1.el8ap
python-idna (Red Hat package) - update to 3.7-1.el9ap
python-aiohttp (Red Hat package) - addressed in versions 3.9.4-1.el8ui, 3.9.5-1.el9ap
python3x-aiohttp (Red Hat package) - update to 3.9.5-1.el8ap
Security QRadar EDR - update to 3.12.9
python-djangorestframework (Red Hat package) - update to 3.14.0-4.el8ui
python-pycryptodomex (Red Hat package) - update to 3.20.0-1.el8ui
python-pulp-rpm-client (Red Hat package) - update to 3.25.4-1.0.1.el8ui
python-pulp-rpm (Red Hat package) - update to 3.26.1-1.el8ui
python3x-pulpcore (Red Hat package) - update to 3.28.27-1.el8ap
python-pulpcore (Red Hat package) - addressed in versions 3.28.27-1.el9ap, 3.49.22-1.el8ui
python-pulpcore-client (Red Hat package) - update to 3.49.19-1.0.2.el8ui
python-async-timeout (Red Hat package) - update to 4.0.2-6.el8ui
python-uritemplate (Red Hat package) - update to 4.1.1-6.el8ui
python-pycares (Red Hat package) - update to 4.1.2-6.el8ui
QRadar User Behavior Analytics - update to 4.1.17
fence-agents (Red Hat package) - addressed in versions 4.2.1-65.el8_4.15, 4.2.1-89.el8_6.12, 4.2.1-112.el8_8.6, 4.10.0-20.el9_0.13, 4.10.0-62.el9_4.3
python-django (Red Hat package) - update to 4.2.15-1.el8ui
python-redis (Red Hat package) - update to 4.3.4-5.el8ui
automation-controller (Red Hat package) - addressed in versions 4.5.7-1.el8ap, 4.5.7-1.el9ap, 4.5.8-1.el8ap, 4.5.8-1.el9ap
python-typing-extensions (Red Hat package) - update to 4.7.1-5.el8ui
Cloud Pak for Data - update to 4.8.5
automation-hub (Red Hat package) - addressed in versions 4.9.2-1.el8ap, 4.9.2-1.el9ap
python3x-galaxy-ng (Red Hat package) - update to 4.9.2-1.el8ap
python-galaxy-ng (Red Hat package) - update to 4.9.2-1.el9ap
fence-agents-vmware-rest - update to 4.10.0-62.0.1
fence-agents-amt-ws - update to 4.10.0-62.0.1
fence-agents-rhevm - update to 4.10.0-62.0.1
fence-agents-rsa - update to 4.10.0-62.0.1
fence-agents-all - update to 4.10.0-62.0.1
ha-cloud-support - update to 4.10.0-62.0.1
fence-agents-rsb - update to 4.10.0-62.0.1
fence-virtd-tcp - update to 4.10.0-62.0.1
fence-virtd-serial - update to 4.10.0-62.0.1
fence-agents-sbd - update to 4.10.0-62.0.1
fence-virtd-multicast - update to 4.10.0-62.0.1
fence-agents-scsi - update to 4.10.0-62.0.1
fence-virtd-libvirt - update to 4.10.0-62.0.1
fence-agents-virsh - update to 4.10.0-62.0.1
fence-agents-eps - update to 4.10.0-62.0.1
fence-agents-vmware-soap - update to 4.10.0-62.0.1
fence-agents-wti - update to 4.10.0-62.0.1
fence-virtd-cpg - update to 4.10.0-62.0.1
fence-virtd - update to 4.10.0-62.0.1
fence-virt - update to 4.10.0-62.0.1
fence-agents-gce - update to 4.10.0-62.0.1
fence-agents-azure-arm - update to 4.10.0-62.0.1
fence-agents-kdump - update to 4.10.0-62.0.1
fence-agents-aws - update to 4.10.0-62.0.1
fence-agents-aliyun - update to 4.10.0-62.0.1
fence-agents-redfish - update to 4.10.0-62.0.1
fence-agents-kubevirt - update to 4.10.0-62.0.1
fence-agents-apc - update to 4.10.0-62.0.1
fence-agents-emerson - update to 4.10.0-62.0.1
fence-agents-eaton-snmp - update to 4.10.0-62.0.1
fence-agents-hpblade - update to 4.10.0-62.0.1
fence-agents-drac5 - update to 4.10.0-62.0.1
fence-agents-ibm-powervs - update to 4.10.0-62.0.1
fence-agents-common - update to 4.10.0-62.0.1
fence-agents-ibm-vpc - update to 4.10.0-62.0.1
fence-agents-ibmblade - update to 4.10.0-62.0.1
fence-agents-heuristics-ping - update to 4.10.0-62.0.1
fence-agents-cisco-ucs - update to 4.10.0-62.0.1
fence-agents-ifmib - update to 4.10.0-62.0.1
fence-agents-cisco-mds - update to 4.10.0-62.0.1
fence-agents-ilo-moonshot - update to 4.10.0-62.0.1
fence-agents-mpath - update to 4.10.0-62.0.1
fence-agents-lpar - update to 4.10.0-62.0.1
fence-agents-ipmilan - update to 4.10.0-62.0.1
fence-agents-ipdu - update to 4.10.0-62.0.1
fence-agents-intelmodular - update to 4.10.0-62.0.1
fence-agents-apc-snmp - update to 4.10.0-62.0.1
fence-agents-ilo2 - update to 4.10.0-62.0.1
fence-agents-ilo-ssh - update to 4.10.0-62.0.1
fence-agents-ilo-mp - update to 4.10.0-62.0.1
fence-agents-bladecenter - update to 4.10.0-62.0.1
fence-agents-brocade - update to 4.10.0-62.0.1
python-jsonschema (Red Hat package) - update to 4.10.3-4.el8ui
Red Hat Update Infrastructure (RHUI) - update to 4.11.0
rhui-installer (Red Hat package) - update to 4.11.0.2-1.el8ui
rhui-tools (Red Hat package) - update to 4.11.0.4-1.el8ui
Red Hat OpenShift Container Platform - addressed in versions 4.12.63, 4.12.64, 4.12.65, 4.13.45, 4.13.48, 4.13.49, 4.14.32, 4.14.33, 4.14.34, 4.14.35, 4.15.25, 4.15.28, 4.15.31, 4.16.7
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.14.13, 4.15.9, 4.16.4, 4.17.1
python-protobuf (Red Hat package) - update to 4.21.6-5.el8ui
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
watsonx Assistant Cartridge - update to 5.1.1
IBM Storage Scale System - addressed in versions 5.1.9.5, 5.2.1.0
python3x-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el8ap
python-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el9ap
python-pyyaml (Red Hat package) - update to 5.4.1-8.0.1.el8ui
SOAR QRadar Plugin App - update to 5.5.0
kernel (Red Hat package) - addressed in versions 5.14.0-284.77.1.el9_2, 5.14.0-284.82.1.el9_2
kernel-rt (Red Hat package) - addressed in versions 5.14.0-284.77.1.rt14.362.el9_2, 5.14.0-284.82.1.rt14.367.el9_2
python-whitenoise (Red Hat package) - update to 6.0.0-5.el8ui
python-importlib-metadata (Red Hat package) - update to 6.0.1-5.el8ui
python-multidict (Red Hat package) - update to 6.0.4-5.el8ui
IBM Qradar SIEM - update to 7.5.0 Update Pack 9 IF03
python-click (Red Hat package) - update to 8.1.3-5.el8ui
IBM Maximo Application Suite - addressed in versions 8.10.17, 8.11.14, 9.0.2
Maximo Application Suite - Edge Data Collector - addressed in versions 8.11.8, 9.0.1
Maximo Application Suite - Monitor Component - addressed in versions 8.11.12, 9.0.4
python3x-pillow (Red Hat package) - update to 10.3.0-1.el8ap
python-pillow (Red Hat package) - update to 10.3.0-1.el9ap
Oracle Solaris - update to 11.4 SRU 71
python-packaging (Red Hat package) - update to 21.3-6.el8ui
python-attrs (Red Hat package) - update to 21.4.0-6.el8ui
python3x-gunicorn (Red Hat package) - update to 22.0.0-1.el8ap
python-gunicorn (Red Hat package) - addressed in versions 22.0.0-1.el9ap, 22.0.0-1.0.1.el8ui
python-aiofiles (Red Hat package) - update to 22.1.0-5.el8ui
python3x-black (Red Hat package) - update to 22.8.0-2.el8ap
python-black (Red Hat package) - update to 22.8.0-2.el9ap
python-django-filter (Red Hat package) - update to 23.2-4.el8ui
python3x-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el8ap
python-pyOpenSSL (Red Hat package) - addressed in versions 24.1.0-1.el9ap, 24.1.0-1.el8ui
python3x-cryptography (Red Hat package) - update to 42.0.5-1.el8ap
python-cryptography (Red Hat package) - addressed in versions 42.0.5-1.el9ap, 42.0.8-1.el8ui
python-pytz (Red Hat package) - update to 2022.2.1-6.el8ui
python-certifi (Red Hat package) - update to 2022.12.7-5.0.1.el8ui
python-uuid6 (Red Hat package) - update to 2023.5.2-5.el8ui
python-diff-match-patch (Red Hat package) - update to 20200713-7.el8ui

• https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj
• https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb

• XSS in Jinja
• Fedora 39 update for mingw-python-jinja2
• Fedora 40 update for mingw-python-jinja2
• Fedora 41 update for python-jinja2
• Fedora 38 update for python-jinja2
• Fedora 39 update for python-jinja2
• Fedora 40 update for python-jinja2
• openEuler update for python-jinja2
• Ubuntu update for jinja2
• SUSE update for python-Jinja2
• Red Hat Enterprise Linux 8 update for fence-agents
• Red Hat Enterprise Linux 8.8 Extended Update Support update for fence-agents
• Red Hat Enterprise Linux 9 update for fence-agents
• Fedora EPEL 8 update for python39-jinja2-epel
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in IBM Storage Protect Plus File Systems Agent
• Amazon Linux AMI update for python-jinja2
• Amazon Linux AMI update for ansible-core
• Cross-site scripting in IBM Process Mining
• Red Hat Enterprise Linux 8 update for python-jinja2
• Red Hat Enterprise Linux 8 update for fence-agents
• Red Hat Enterprise Linux 9 update for fence-agents
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• SUSE update for python-Jinja2
• Oracle Solaris update for thrid-party components
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Function Cloud Native Environment
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Cross-site scripting in Red Hat OpenShift Container Platform 4.15 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Cross-site scripting in IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in IBM Security QRadar EDR
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Cross-site scripting in IBM Storage Scale
• Cross-site scripting in IBM Maximo Application Suite
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Cross-site scripting in Red Hat OpenShift Container Platform 4.13 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Cross-site scripting in IBM Truststore Manager
• Multiple vulnerabilities in IBM QRadar SIEM
• F5 Traffix SDC update for Python-jinja
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• IBM Edge Data Collector update for Jinja
• IBM Maximo Application Suite - Monitor Component update for Jinja
• Red Hat Enterprise Linux 9 update for python-jinja2
• Multiple vulnerabilities in IBM QRadar User Behavior Analytics
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.17
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.16
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.15
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.14
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications User Data Repository
• Multiple vulnerabilities in Oracle Communications Operations Monitor
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Financial Services Compliance Studio
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI)
• Multiple vulnerabilities in IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
• Multiple vulnerabilities in QRadar Advisor With Watson for IBM QRadar SIEM
• Multiple vulnerabilities in IBM Concert Software
• Anolis OS update for python-jinja2
• Anolis OS update for python-jinja2
• Anolis OS update for fence-agents
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle Communications Diameter Signaling Router
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Repository Function
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• IBM Cloud Pak for Data System 1.0 update for Jinja
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Exposure Function
• Multiple vulnerabilities in IBM watsonx.data