Skip to content
This repository has been archived by the owner on Nov 28, 2022. It is now read-only.

Upgrade Jinja2 to 2.10.1 #4

Closed
wants to merge 1 commit into from
Closed

Upgrade Jinja2 to 2.10.1 #4

wants to merge 1 commit into from

Conversation

gene1wood
Copy link

@gene1wood gene1wood commented Nov 25, 2019

Mitigate CVE-2016-10745 and CVE-2019-10906. str.format_map and str.format allow a sandbox escape.

Though webowonder doesn't use str.format_map it does use str.format.

I can't tell if the user can control the payload in this location

https://github.com/mozilla/webowonder/blob/9fa31e64db1411839397b3cea09279540538b190/apps/wow/views.py

If so, this could result in an exploit

Mitigate [CVE-2016-10745](GHSA-hj2j-77xm-mc5v) and [CVE-2019-10906](GHSA-462w-v97r-4m45). `str.format_map` allows a sandbox escape.

Though webowonder doesn't use `str.format_map`, upgrading Jinja2 will prevent this vulnerability from causing a problem if the code changes down the road to use this function.
@gene1wood
Copy link
Author

I've opened https://bugzilla.mozilla.org/show_bug.cgi?id=1802955 to get this merged or the repo archived.

@gene1wood gene1wood closed this by deleting the head repository Dec 31, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant