PT-2021-7288 · Jinja2+8 · Jinja2+8
Yeting Li
·
Published
2021-02-01
·
Updated
2025-09-29
·
CVE-2020-28493
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
jinja2 versions 0.0.0 through 2.11.3
Description
The issue is mainly due to the
punctuation re regex operator and its use of multiple wildcards, with the last wildcard being the most exploitable as it searches for trailing punctuation. This can cause a ReDoS vulnerability, potentially leading to a denial of service. The vulnerability can be exploited by a remote attacker. The issue can also be attributed to the sub-pattern [a-zA-Z0-9. -]+.[a-zA-Z0-9. -]+ in the regex.Recommendations
For jinja2 versions 0.0.0 through 2.11.3, mitigate the issue by using Markdown to format user content instead of the
urlize filter, or by implementing request timeouts and limiting process memory.Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu
Jinja2