Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2024-56326

Protection Mechanism Failure

Published: Dec 23, 2024 | Modified: Nov 03, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
6.3 MODERATE
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-56326
CWEhttps://cwe.mitre.org/data/definitions/693.html

Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinjas sandbox does catch calls to str.format and ensures they dont escape the sandbox. However, its possible to store a reference to a malicious strings format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.

Weakness

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Affected Software

NameVendorStart VersionEnd Version
JinjaPalletsprojects*3.1.5 (excluding)
Ansible Automation Platform Execution EnvironmentsRedHatansible-automation-platform/ee-minimal-rhel8:2.16.14-3*
Ansible Automation Platform Execution EnvironmentsRedHatansible-automation-platform/ee-minimal-rhel9:2.18.1-4*
Ansible Automation Platform Execution EnvironmentsRedHatansible-automation-platform/ee-minimal-rhel8:2.12.10-59*
Ansible Automation Platform Execution EnvironmentsRedHatansible-automation-platform/ee-minimal-rhel9:2.18.2-4*
Discovery 1 for RHEL 9RedHatdiscovery/discovery-server-rhel9:1.12.0-1*
Discovery 1 for RHEL 9RedHatdiscovery/discovery-ui-rhel9:1.12.0-1*
Ironic content for Red Hat OpenShift Container Platform 4.12RedHatpython-jinja2-0:3.0.1-6.el9.2*
Ironic content for Red Hat OpenShift Container Platform 4.13RedHatpython-jinja2-0:3.0.1-6.el9.2*
Red Hat Ansible Automation Platform 2.4 for RHEL 8RedHatautomation-controller-0:4.5.17-1.el8ap*
Red Hat Ansible Automation Platform 2.4 for RHEL 8RedHatpython3x-jinja2-0:3.1.5-1.el8ap*
Red Hat Ansible Automation Platform 2.4 for RHEL 8RedHatansible-automation-platform-24/lightspeed-rhel8-operator:2.4-33*
Red Hat Ansible Automation Platform 2.4 for RHEL 9RedHatautomation-controller-0:4.5.17-1.el9ap*
Red Hat Ansible Automation Platform 2.4 for RHEL 9RedHatpython-jinja2-0:3.1.5-1.el9ap*
Red Hat Ansible Automation Platform 2.5 for RHEL 8RedHatansible-automation-platform-25/lightspeed-rhel8:2.5.250107-1*
Red Hat Ansible Automation Platform 2.5 for RHEL 8RedHatautomation-controller-0:4.6.7-1.el8ap*
Red Hat Ansible Automation Platform 2.5 for RHEL 8RedHatpython3.11-jinja2-0:3.1.5-1.el8ap*
Red Hat Ansible Automation Platform 2.5 for RHEL 9RedHatautomation-controller-0:4.6.7-1.el9ap*
Red Hat Ansible Automation Platform 2.5 for RHEL 9RedHatpython3.11-jinja2-0:3.1.5-1.el9ap*
Red Hat Developer Hub 1.3 on RHEL 9RedHatrhdh-hub-container-1.3-138*
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRedHatpython-jinja2-0:2.7.2-5.el7_9*
Red Hat Enterprise Linux 8RedHatpython-jinja2-0:2.10.1-6.el8_10*
Red Hat Enterprise Linux 8.2 Advanced Update SupportRedHatpython-jinja2-0:2.10.1-2.el8_2.3*
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRedHatpython-jinja2-0:2.10.1-2.el8_4.1*
Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceRedHatpython-jinja2-0:2.10.1-2.el8_4.1*
Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsRedHatpython-jinja2-0:2.10.1-2.el8_4.1*
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRedHatpython-jinja2-0:2.10.1-4.el8_6.1*
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRedHatpython-jinja2-0:2.10.1-4.el8_6.1*
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRedHatpython-jinja2-0:2.10.1-4.el8_6.1*
Red Hat Enterprise Linux 8.8 Extended Update SupportRedHatpython-jinja2-0:2.10.1-4.el8_8.1*
Red Hat Enterprise Linux 9RedHatfence-agents-0:4.10.0-76.el9_5.4*
Red Hat Enterprise Linux 9RedHatpython-jinja2-0:2.11.3-7.el9_5*
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRedHatfence-agents-0:4.10.0-20.el9_0.20*
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRedHatpython-jinja2-0:2.11.3-4.el9_0.1*
Red Hat Enterprise Linux 9.2 Extended Update SupportRedHatfence-agents-0:4.10.0-43.el9_2.11*
Red Hat Enterprise Linux 9.2 Extended Update SupportRedHatpython-jinja2-0:2.11.3-4.el9_2.1*
Red Hat Enterprise Linux 9.4 Extended Update SupportRedHatfence-agents-0:4.10.0-62.el9_4.10*
Red Hat Enterprise Linux 9.4 Extended Update SupportRedHatpython-jinja2-0:2.11.3-6.el9_4*
Red Hat OpenShift Container Platform 4.12RedHatopenshift4/ose-ansible-operator:v4.12.0-202502040858.p0.g0bd975e.assembly.stream.el8*
Red Hat OpenShift Container Platform 4.13RedHatopenshift4/ose-ansible-operator:v4.13.0-202503111300.p0.g01bfabb.assembly.stream.el8*
Red Hat OpenShift Container Platform 4.14RedHatpython-jinja2-0:3.0.1-6.el9.2*
Red Hat OpenShift Container Platform 4.15RedHatopenshift4/ose-ansible-operator:v4.15.0-202502171304.p0.g52fc4b9.assembly.stream.el8*
Red Hat OpenShift Container Platform 4.15RedHatpython-jinja2-0:3.0.1-6.el9.2*
Red Hat OpenShift Container Platform 4.16RedHatopenshift4/ose-ansible-rhel9-operator:v4.16.0-202501311735.p0.g2cb0020.assembly.stream.el9*
Red Hat OpenShift Container Platform 4.16RedHatpython-jinja2-0:3.0.1-6.el9.2*
Red Hat OpenShift Container Platform 4.17RedHatopenshift4/ose-ansible-rhel9-operator:v4.17.0-202501300634.p0.g9cb5839.assembly.stream.el9*
Red Hat OpenShift Container Platform 4.17RedHatpython-jinja2-0:3.1.5-1.el9*
Red Hat OpenStack Platform 17.1 for RHEL 9RedHatopenstack-ansible-core-0:2.14.2-4.6.el9ost*
Red Hat Satellite 6.16 for RHEL 8RedHatpython-jinja2-0:3.1.5-1.el8pc*
Red Hat Satellite 6.16 for RHEL 8RedHatpython-jinja2-0:3.1.5-1.el8pc*
Red Hat Satellite 6.16 for RHEL 9RedHatpython-jinja2-0:3.1.5-1.el9pc*
Red Hat Satellite 6.16 for RHEL 9RedHatpython-jinja2-0:3.1.5-1.el9pc*
Red Hat Satellite 6.17 for RHEL 9RedHatpython-jinja2-0:3.1.5-1.el9pc*
Red Hat Satellite 6.17 for RHEL 9RedHatpython-jinja2-0:3.1.5-1.el9pc*
Red Hat Developer Hub 1.5RedHatrhdh/rhdh-hub-rhel9:sha256:56bfbb2328f42e91d0462e142f3434e5d771737defbc07d8a21dbdf50e468665*
Red Hat Developer Hub (RHDH) 1.4RedHatrhdh/rhdh-hub-rhel9:sha256:d8268197ba0466643efb818fcad8f0fc29e32463f75b0f7f51d9ce75ec717572*
Jinja2Ubuntuesm-infra-legacy/trusty*
Jinja2Ubuntuesm-infra/bionic*
Jinja2Ubuntuesm-infra/focal*
Jinja2Ubuntuesm-infra/xenial*
Jinja2Ubuntufocal*
Jinja2Ubuntujammy*
Jinja2Ubuntunoble*
Jinja2Ubuntuoracular*
Jinja2Ubuntuupstream*

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use