Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

mkdocs_macros_plugin-0.7.0-py3-none-any.whl: 4 vulnerabilities (highest severity is: 8.8) #45

Open
mend-bolt-for-github bot opened this issue Mar 14, 2024 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-bolt-for-github
Copy link
Contributor

mend-bolt-for-github bot commented Mar 14, 2024

Vulnerable Library - mkdocs_macros_plugin-0.7.0-py3-none-any.whl

Path to dependency file: /docs/build/requirements.txt

Path to vulnerable library: /docs/build/requirements.txt

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (mkdocs_macros_plugin version) Remediation Possible**
CVE-2024-56201 High 8.8 Jinja2-3.1.2-py3-none-any.whl Transitive N/A*
CVE-2024-56326 Medium 6.7 Jinja2-3.1.2-py3-none-any.whl Transitive N/A*
CVE-2024-34064 Medium 5.4 Jinja2-3.1.2-py3-none-any.whl Transitive N/A*
CVE-2024-22195 Medium 5.4 Jinja2-3.1.2-py3-none-any.whl Transitive N/A*

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-56201

Vulnerable Library - Jinja2-3.1.2-py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/bc/c3/f068337a370801f372f2f8f6bad74a5c140f6fda3d9de154052708dd3c65/Jinja2-3.1.2-py3-none-any.whl

Path to dependency file: /docs/build/requirements.txt

Path to vulnerable library: /docs/build/requirements.txt

Dependency Hierarchy:

  • mkdocs_macros_plugin-0.7.0-py3-none-any.whl (Root Library)
    • Jinja2-3.1.2-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Jinja is an extensible templating engine. Prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.

Publish Date: 2024-12-23

URL: CVE-2024-56201

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gmj6-6f8f-6699

Release Date: 2024-12-23

Fix Resolution: jinja2 - 3.1.5

Step up your Open Source Security Game with Mend here

CVE-2024-56326

Vulnerable Library - Jinja2-3.1.2-py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/bc/c3/f068337a370801f372f2f8f6bad74a5c140f6fda3d9de154052708dd3c65/Jinja2-3.1.2-py3-none-any.whl

Path to dependency file: /docs/build/requirements.txt

Path to vulnerable library: /docs/build/requirements.txt

Dependency Hierarchy:

  • mkdocs_macros_plugin-0.7.0-py3-none-any.whl (Root Library)
    • Jinja2-3.1.2-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.
Mend Note: Mend score differs from Mitre (CISA-ADP) because it considers factors such as required user interaction, local access constraints, and limited privilege requirements, which collectively lower the vulnerability score.

Publish Date: 2024-12-23

URL: CVE-2024-56326

CVSS 3 Score Details (6.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q2x7-8rv6-6q7h

Release Date: 2024-12-23

Fix Resolution: jinja2 - 3.1.5

Step up your Open Source Security Game with Mend here

CVE-2024-34064

Vulnerable Library - Jinja2-3.1.2-py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/bc/c3/f068337a370801f372f2f8f6bad74a5c140f6fda3d9de154052708dd3c65/Jinja2-3.1.2-py3-none-any.whl

Path to dependency file: /docs/build/requirements.txt

Path to vulnerable library: /docs/build/requirements.txt

Dependency Hierarchy:

  • mkdocs_macros_plugin-0.7.0-py3-none-any.whl (Root Library)
    • Jinja2-3.1.2-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, >, or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for CVE-2024-22195 only addressed spaces but not other characters. Accepting keys as user input is now explicitly considered an unintended use case of the xmlattr filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting values as user input continues to be safe. This vulnerability is fixed in 3.1.4.

Publish Date: 2024-05-06

URL: CVE-2024-34064

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h75v-3vvj-5mfj

Release Date: 2024-05-06

Fix Resolution: Jinja2 - 3.1.4

Step up your Open Source Security Game with Mend here

CVE-2024-22195

Vulnerable Library - Jinja2-3.1.2-py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/bc/c3/f068337a370801f372f2f8f6bad74a5c140f6fda3d9de154052708dd3c65/Jinja2-3.1.2-py3-none-any.whl

Path to dependency file: /docs/build/requirements.txt

Path to vulnerable library: /docs/build/requirements.txt

Dependency Hierarchy:

  • mkdocs_macros_plugin-0.7.0-py3-none-any.whl (Root Library)
    • Jinja2-3.1.2-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja xmlattr filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.

Publish Date: 2024-01-11

URL: CVE-2024-22195

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h5c8-rqwp-cp95

Release Date: 2024-01-11

Fix Resolution: jinja2 - 3.1.3

Step up your Open Source Security Game with Mend here

@mend-bolt-for-github mend-bolt-for-github bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Mar 14, 2024
@mend-bolt-for-github mend-bolt-for-github bot changed the title mkdocs_macros_plugin-0.7.0-py3-none-any.whl: 1 vulnerabilities (highest severity is: 6.1) mkdocs_macros_plugin-0.7.0-py3-none-any.whl: 2 vulnerabilities (highest severity is: 6.1) May 7, 2024
@mend-bolt-for-github mend-bolt-for-github bot changed the title mkdocs_macros_plugin-0.7.0-py3-none-any.whl: 2 vulnerabilities (highest severity is: 6.1) mkdocs_macros_plugin-0.7.0-py3-none-any.whl: 2 vulnerabilities (highest severity is: 5.4) Aug 1, 2024
@mend-bolt-for-github mend-bolt-for-github bot changed the title mkdocs_macros_plugin-0.7.0-py3-none-any.whl: 2 vulnerabilities (highest severity is: 5.4) mkdocs_macros_plugin-0.7.0-py3-none-any.whl: 4 vulnerabilities (highest severity is: 10.0) Dec 24, 2024
@mend-bolt-for-github mend-bolt-for-github bot changed the title mkdocs_macros_plugin-0.7.0-py3-none-any.whl: 4 vulnerabilities (highest severity is: 10.0) mkdocs_macros_plugin-0.7.0-py3-none-any.whl: 4 vulnerabilities (highest severity is: 8.8) Dec 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Development

No branches or pull requests

0 participants