https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 05:05:05 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:2132 <p><strong>Affected:</strong> AlmaLinux:9: fence-agents-aliyun, AlmaLinux:9: fence-agents-all, AlmaLinux:9: fence-agents-amt-ws, AlmaLinux:9: fence-agents-apc, AlmaLinux:9: fence-agents-apc-snmp, AlmaLinux:9: fence-agents-aws, AlmaLinux:9: fence-agents-azure-arm, AlmaLinux:9: fence-agents-bladecenter, AlmaLinux:9: fence-agents-brocade, AlmaLinux:9: fence-agents-cisco-mds and 45 more</p> <p>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.</p> <p>Security Fix(es):</p> <p>* urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803) * pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323) * jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: fence-agents-aliyun, AlmaLinux:9: fence-agents-all, AlmaLinux:9: fence-agents-amt-ws, AlmaLinux:9: fence-agents-apc, AlmaLinux:9: fence-agents-apc-snmp, AlmaLinux:9: fence-agents-aws, AlmaLinux:9: fence-agents-azure-arm, AlmaLinux:9: fence-agents-bladecenter, AlmaLinux:9: fence-agents-brocade, AlmaLinux:9: fence-agents-cisco-mds and 45 more</p> <p>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.</p> <p>Security Fix(es):</p> <p>* urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803) * pycryptodome: side-channel leakage for OAEP decryption in PyCryptodome and pycryptodomex (CVE-2023-52323) * jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:2132 https://cve.radiocsirt.org/vuln/bdu:2024-00884 bdu:2024-00884 https://cve.radiocsirt.org/vuln/bdu:2024-00884 https://cve.radiocsirt.org/vuln/bell-cve-2024-22195 <p><strong>Affected:</strong> Alpaquita:23: py3-jinja2, Alpaquita:stream: py3-jinja2</p> <p><strong>Affected:</strong> Alpaquita:23: py3-jinja2, Alpaquita:stream: py3-jinja2</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-22195 https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2024-22195 <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.</p> <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.</p> https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2024-22195 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0305 certfr-2024-avi-0305 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0305 https://cve.radiocsirt.org/vuln/euvd-2026-258564 EUVD-2026-258564 https://cve.radiocsirt.org/vuln/euvd-2026-258564 https://cve.radiocsirt.org/vuln/fkie_cve-2024-22195 <p>Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.</p> <p>Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-22195 https://cve.radiocsirt.org/vuln/ghsa-h5c8-rqwp-cp95 <p><strong>Affected:</strong> PyPI: jinja2</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.</p> <p><strong>Affected:</strong> PyPI: jinja2</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.</p> https://cve.radiocsirt.org/vuln/ghsa-h5c8-rqwp-cp95 https://cve.radiocsirt.org/vuln/gsd-2024-22195 gsd-2024-22195 https://cve.radiocsirt.org/vuln/gsd-2024-22195 https://cve.radiocsirt.org/vuln/msrc_cve-2024-22195 msrc_CVE-2024-22195 https://cve.radiocsirt.org/vuln/msrc_cve-2024-22195 https://cve.radiocsirt.org/vuln/oesa-2024-1128 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: python-jinja2, openEuler:20.03-LTS-SP4: python-jinja2, openEuler:22.03-LTS: python-jinja2, openEuler:22.03-LTS-SP1: python-jinja2, openEuler:22.03-LTS-SP2: python-jinja2, openEuler:22.03-LTS-SP3: python-jinja2</p> <p>Jinja2 is one of the most used template engines for Python. It is inspired by Django&amp;apos;s templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications where security is important. Security Fix(es): Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based. (CVE-2024-22195)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: python-jinja2, openEuler:20.03-LTS-SP4: python-jinja2, openEuler:22.03-LTS: python-jinja2, openEuler:22.03-LTS-SP1: python-jinja2, openEuler:22.03-LTS-SP2: python-jinja2, openEuler:22.03-LTS-SP3: python-jinja2</p> <p>Jinja2 is one of the most used template engines for Python. It is inspired by Django&amp;apos;s templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications where security is important. Security Fix(es): Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based. (CVE-2024-22195)</p> https://cve.radiocsirt.org/vuln/oesa-2024-1128 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13581-1 <p>python310-Jinja2-3.1.3-1.1 on GA media</p> <p>python310-Jinja2-3.1.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13581-1 https://cve.radiocsirt.org/vuln/pysec-2026-1473 <p><strong>Affected:</strong> PyPI: jinja2</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.</p> <p><strong>Affected:</strong> PyPI: jinja2</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. Note that accepting keys as user input is not common or a particularly intended use case of the `xmlattr` filter, and an application doing so should already be verifying what keys are provided regardless of this fix.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1473 https://cve.radiocsirt.org/vuln/rhba-2024:0891 <p>jinja2: HTML attribute injection when passing user input as keys to xmlattr filter</p> <p>jinja2: HTML attribute injection when passing user input as keys to xmlattr filter</p> https://cve.radiocsirt.org/vuln/rhba-2024:0891 https://cve.radiocsirt.org/vuln/suse-su-2024:1863-1 <p>Security update for python-Jinja2</p> <p>Security update for python-Jinja2</p> https://cve.radiocsirt.org/vuln/suse-su-2024:1863-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-22195 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jinja2, Ubuntu:Pro:16.04:LTS: jinja2, Ubuntu:Pro:18.04:LTS: jinja2, Ubuntu:20.04:LTS: jinja2, Ubuntu:22.04:LTS: jinja2, Ubuntu:24.04:LTS: jinja2</p> <p>Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jinja2, Ubuntu:Pro:16.04:LTS: jinja2, Ubuntu:Pro:18.04:LTS: jinja2, Ubuntu:20.04:LTS: jinja2, Ubuntu:22.04:LTS: jinja2, Ubuntu:24.04:LTS: jinja2</p> <p>Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja `xmlattr` filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-22195 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0522 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, Phishing-Angriffe durchzuführen oder Cross-Site Scripting (XSS)-Angriffe auszuführen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um sie erfolgreich auszunutzen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren, Phishing-Angriffe durchzuführen oder Cross-Site Scripting (XSS)-Angriffe auszuführen. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um sie erfolgreich auszunutzen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0522