https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:40:24 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:3820 <p><strong>Affected:</strong> AlmaLinux:9: fence-agents-aliyun, AlmaLinux:9: fence-agents-all, AlmaLinux:9: fence-agents-amt-ws, AlmaLinux:9: fence-agents-apc, AlmaLinux:9: fence-agents-apc-snmp, AlmaLinux:9: fence-agents-aws, AlmaLinux:9: fence-agents-azure-arm, AlmaLinux:9: fence-agents-bladecenter, AlmaLinux:9: fence-agents-brocade, AlmaLinux:9: fence-agents-cisco-mds and 45 more</p> <p>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.</p> <p>Security Fix(es):</p> <p>* jinja2: accepts keys containing non-attribute characters (CVE-2024-34064)</p> <p><strong>Affected:</strong> AlmaLinux:9: fence-agents-aliyun, AlmaLinux:9: fence-agents-all, AlmaLinux:9: fence-agents-amt-ws, AlmaLinux:9: fence-agents-apc, AlmaLinux:9: fence-agents-apc-snmp, AlmaLinux:9: fence-agents-aws, AlmaLinux:9: fence-agents-azure-arm, AlmaLinux:9: fence-agents-bladecenter, AlmaLinux:9: fence-agents-brocade, AlmaLinux:9: fence-agents-cisco-mds and 45 more</p> <p>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.</p> <p>Security Fix(es):</p> <p>* jinja2: accepts keys containing non-attribute characters (CVE-2024-34064)</p> https://cve.radiocsirt.org/vuln/alsa-2024:3820 https://cve.radiocsirt.org/vuln/bdu:2025-00945 bdu:2025-00945 https://cve.radiocsirt.org/vuln/bdu:2025-00945 https://cve.radiocsirt.org/vuln/bell-cve-2024-34064 <p><strong>Affected:</strong> Alpaquita:23: py3-jinja2, Alpaquita:stream: py3-jinja2</p> <p><strong>Affected:</strong> Alpaquita:23: py3-jinja2, Alpaquita:stream: py3-jinja2</p> https://cve.radiocsirt.org/vuln/bell-cve-2024-34064 https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2024-34064 <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.</p> <p>Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.</p> <p><strong>Affected:</strong> Homebrew: adr-viewer</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.</p> <p>Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.</p> https://cve.radiocsirt.org/vuln/brew-adr-viewer-cve-2024-34064 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0579 certfr-2024-avi-0579 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0579 https://cve.radiocsirt.org/vuln/euvd-2026-258595 EUVD-2026-258595 https://cve.radiocsirt.org/vuln/euvd-2026-258595 https://cve.radiocsirt.org/vuln/fkie_cve-2024-34064 <p>Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.</p> <p>Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-34064 https://cve.radiocsirt.org/vuln/ghsa-h75v-3vvj-5mfj <p><strong>Affected:</strong> PyPI: Jinja2</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.</p> <p>Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.</p> <p><strong>Affected:</strong> PyPI: Jinja2</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.</p> <p>Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.</p> https://cve.radiocsirt.org/vuln/ghsa-h75v-3vvj-5mfj https://cve.radiocsirt.org/vuln/msrc_cve-2024-34064 msrc_CVE-2024-34064 https://cve.radiocsirt.org/vuln/msrc_cve-2024-34064 https://cve.radiocsirt.org/vuln/oesa-2024-1605 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: python-jinja2, openEuler:20.03-LTS-SP4: python-jinja2, openEuler:22.03-LTS: python-jinja2, openEuler:22.03-LTS-SP1: python-jinja2, openEuler:22.03-LTS-SP2: python-jinja2, openEuler:22.03-LTS-SP3: python-jinja2</p> <p>Jinja2 is one of the most used template engines for Python. It is inspired by Django&amp;apos;s templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications where security is important. Security Fix(es): Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&amp;gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.(CVE-2024-34064)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: python-jinja2, openEuler:20.03-LTS-SP4: python-jinja2, openEuler:22.03-LTS: python-jinja2, openEuler:22.03-LTS-SP1: python-jinja2, openEuler:22.03-LTS-SP2: python-jinja2, openEuler:22.03-LTS-SP3: python-jinja2</p> <p>Jinja2 is one of the most used template engines for Python. It is inspired by Django&amp;apos;s templating system but extends it with an expressive language that gives template authors a more powerful set of tools. On top of that it adds sandboxed execution and optional automatic escaping for applications where security is important. Security Fix(es): Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&amp;gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.(CVE-2024-34064)</p> https://cve.radiocsirt.org/vuln/oesa-2024-1605 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13930-1 <p>python310-Jinja2-3.1.4-1.1 on GA media</p> <p>python310-Jinja2-3.1.4-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:13930-1 https://cve.radiocsirt.org/vuln/pysec-2026-1474 <p><strong>Affected:</strong> PyPI: jinja2</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.</p> <p>Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.</p> <p><strong>Affected:</strong> PyPI: jinja2</p> <p>The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.</p> <p>Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1474 https://cve.radiocsirt.org/vuln/rhea-2024:4071 <p>pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools jsonata: malicious expression can pollute the &#34;Object&#34; prototype jinja2: accepts keys containing non-attribute characters requests: subsequent requests to the same host ignore cert verification</p> <p>pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools jsonata: malicious expression can pollute the &#34;Object&#34; prototype jinja2: accepts keys containing non-attribute characters requests: subsequent requests to the same host ignore cert verification</p> https://cve.radiocsirt.org/vuln/rhea-2024:4071 https://cve.radiocsirt.org/vuln/suse-su-2024:1863-1 <p>Security update for python-Jinja2</p> <p>Security update for python-Jinja2</p> https://cve.radiocsirt.org/vuln/suse-su-2024:1863-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-34064 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jinja2, Ubuntu:Pro:16.04:LTS: jinja2, Ubuntu:Pro:18.04:LTS: jinja2, Ubuntu:20.04:LTS: jinja2, Ubuntu:22.04:LTS: jinja2, Ubuntu:24.04:LTS: jinja2</p> <p>Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: jinja2, Ubuntu:Pro:16.04:LTS: jinja2, Ubuntu:Pro:18.04:LTS: jinja2, Ubuntu:20.04:LTS: jinja2, Ubuntu:22.04:LTS: jinja2, Ubuntu:24.04:LTS: jinja2</p> <p>Jinja is an extensible templating engine. The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `&gt;`, or `=`, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the `xmlattr` filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting _values_ as user input continues to be safe. This vulnerability is fixed in 3.1.4.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-34064 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1328 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand erzeugen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren oder Cross-Site-Scripting (XSS)-Angriffe durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand erzeugen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen, Dateien zu manipulieren oder Cross-Site-Scripting (XSS)-Angriffe durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1328