Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.

microsoft_mariner CVE-2024-56201: CVE-2024-56201

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0830 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.16.33. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2025:0828

    Security Fix(es):

    * podman: buildah: Container breakout by using --jobs=2 and a race     condition when building a malicious Containerfile (CVE-2024-11218)
    * jinja2: Jinja has a sandbox breakout through malicious filenames     (CVE-2024-56201)
    * jinja2: Jinja has a sandbox breakout through indirect reference to format     method (CVE-2024-56326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:0842 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.46. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2025:0840

    Security Fix(es):

    * jinja2: Jinja has a sandbox breakout through malicious filenames     (CVE-2024-56201)
    * jinja2: Jinja has a sandbox breakout through indirect reference to format     method (CVE-2024-56326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:0834 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.72. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2025:0832

    Security Fix(es):

    * jinja2: Jinja has a sandbox breakout through malicious filenames     (CVE-2024-56201)
    * jinja2: Jinja has a sandbox breakout through indirect reference to format     method (CVE-2024-56326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7244-1 advisory.

    It was discovered that Jinja2 incorrectly handled certain filenames when compiling template content. An     attacker could possibly use this issue to execute arbitrary code. (CVE-2024-56201)

    It was discovered that Jinja2 incorrectly handled string formatting calls. An attacker could possibly use     this issue to execute arbitrary code. (CVE-2024-56326)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0777 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Jinja has a sandbox breakout through indirect reference to format method     (CVE-2024-56326)
    * automation-controller: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)
    * automation-controller: Django: potential denial-of-service vulnerability in IPv6 validation     (CVE-2024-56374)
    * python3.11-django: potential denial-of-service vulnerability in IPv6 validation (CVE-2024-56374)
    * python3.11-django: Potential denial-of-service in django.utils.html.strip_tags() (CVE-2024-53907)
    * python3.11-jinja2: Jinja has a sandbox breakout through indirect reference to format method     (CVE-2024-56326)
    * python3.11-jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included:

    Automation controller
    * Fixed an issue where the order of source inventories was not respected by the ansible.controller     collection (AAP-38524)
    * Fixed an issue where an actively running job on an execution node may have had its folder deleted by a     system task (AAP-38137)
    * automation-controller has been updated to 4.6.7

    Event-Driven Ansible:
    * Fixed an issue where users were unable to filter Rule Audits by rulebook activation name (AAP-39253)
    * Users are now able to create a new Event-Driven Ansible credential by copying an existing one     (AAP-39249)
    * Added support for file and env injectors for Credentials (AAP-39091)
    * Fixed an issue where the input field of the injector configuration could not be empty (AAP-39086)
    * Fixed an issue where the application version in the openapi spec was incorrectly set (AAP-38392)
    * Fixed an issue where activations were not properly updated in some scenarios with a high load of the     system (AAP-38374)
    * automation-eda-controller has been updated to 1.1.4

    Container-based Ansible Automation Platform
    * Allow user to not provide the Postgresql admin account with external database (AAP-39077)
    * Using PostgreSQL TLS certificate authentication with an external database is now available (AAP-38400)
    * containerized installer setup has been updated to 2.5-9

    RPM-based Ansible Automation Platform
    * Fixed an issue where gateway could not be setup with custom SSL certificates (AAP-38985)
    * Fixed an issue where the gateway services are not restarted when a dependency changes (AAP-38918)
    * Fixed an issue where setting automationedacontroller_max_running_activations could cause the installer     to fail (AAP-38708)
    * ansible-automation-platform-installer and installer setup have been updated to 2.5-8

    Additional changes:
    * python3.11-django has been updated to 4.2.18
    * python3.11-jinja2 has been updated to 3.1.5
    * python3.11-pulpcore has been updated to 3.49.30

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0721 advisory.

    Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing     IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to     individual teams, while automation developers retain the freedom to write tasks that leverage existing     knowledge without the overhead. Ansible Automation Platform makes it possible for users across an     organization to share, vet, and manage automation content by means of a simple, powerful, and agentless     language.

    Security Fix(es):

    * automation-controller: Jinja has a sandbox breakout through indirect reference to format method     (CVE-2024-56326)
    * automation-controller: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)
    * automation-controller: Potential SQL injection in HasKey(lhs, rhs) on Oracle (CVE-2024-53908)
    * python3-jinja2/python39-jinja2: Jinja has a sandbox breakout through indirect reference to format method     (CVE-2024-56326)
    * python3-jinja2/python39-jinja2: Jinja has a sandbox breakout through malicious filenames     (CVE-2024-56201)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Updates and fixes included for automation controller:
    * Fixed an issue where the traceback from host_metric_summary_monthly task caused a type comparison error     (AAP-37486)
    * Fixed an issue where the order of source inventories was not respected by the ansible.controller     collection (AAP-38511)
    * automation-controller has been updated to 4.5.17

    Updates and fixes for installer and setup:
    * Fixed an issue where setting the pg_host= without any other context would result in an empty HOST     section of settings.py in controller (AAP-38030)
    * Fixed an issue where Automation Hub backup would fail when automationhub_pg_port= (AAP-31261)
    * Fixed an issue where providing the database installation a custom port would break the installation of     postgres (AAP-31260)
    * Setup script now warns if provided log path does not have write permission and fails if default path     does not have write permission (AAP-18204)
    * installer and setup have been updated to 2.4-9

    Additional fixes:
    * python3-jinja2/python39-jinja2 has been updated to 3.1.5
    * python3-pulpcore/python39-pulpcore has been updated to 3.28.26

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0656 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.17.14. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2025:0656

    Security Fix(es):

    * jinja2: Jinja has a sandbox breakout through malicious filenames     (CVE-2024-56201)
    * jinja2: Jinja has a sandbox breakout through indirect reference to format     method (CVE-2024-56326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-811 advisory.

    Jinja is an extensible templating engine. Prior to 3.1.5, a bug in the Jinja compiler allows an attacker     that controls both the content and filename of a template to execute arbitrary Python code, regardless of     if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename     and the contents of a template. Whether that is the case depends on the type of application using Jinja.
    This vulnerability impacts users of applications which execute untrusted templates where the template     author can also choose the template filename. This vulnerability is fixed in 3.1.5. (CVE-2024-56201)

    Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed     environment detects calls to str.format allows an attacker that controls the content of a template to     execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a     template. Whether that is the case depends on the type of application using Jinja. This vulnerability     impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to     str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a     malicious string's format method, then pass that to a filter that calls it. No such filters are built-in     to Jinja, but could be present through custom filters in an application. After the fix, such indirect     calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5. (CVE-2024-56326)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6ed1e0c3c6 advisory.

    - Update to 3.1.5
    - Security fix for CVE-2024-56201


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-5f04326f4f advisory.

    Update to jinja2-3.1.5.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-dbe19a2b1f advisory.

    Update to jinja2-3.1.5.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-0308 advisory.

    [4.10.0-76.4]
    - bundled jinja2: fix CVE-2024-56201 and CVE-2024-56326       Resolves: RHEL-72070, RHEL-72063

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of python-jinja2 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-56201 advisory.

  - Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja     compiler allows an attacker that controls both the content and filename of a template to execute arbitrary     Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to     control both the filename and the contents of a template. Whether that is the case depends on the type of     application using Jinja. This vulnerability impacts users of applications which execute untrusted     templates where the template author can also choose the template filename. This vulnerability is fixed in     3.1.5. (CVE-2024-56201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0345 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)

    * jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0335 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)

    * jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0338 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)

    * jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:0308 advisory.

    * fence-agents: Jinja has a sandbox breakout through indirect reference to format method [almalinux-9.5.z]     (CVE-2024-56326)
      * fence-agents: Jinja has a sandbox breakout through malicious filenames [almalinux-9.5.z]     (CVE-2024-56201)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:0308 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * fence-agents: Jinja has a sandbox breakout through indirect reference to format method [rhel-9.5.z]     (CVE-2024-56326)

    * fence-agents: Jinja has a sandbox breakout through malicious filenames [rhel-9.5.z] (CVE-2024-56201)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-7b6e208ef2 advisory.

    - Update to 3.1.5
    - Security fix for CVE-2024-56201


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0006-1 advisory.

    - CVE-2024-56201: Fixed sandbox breakout through malicious content and filename of a template     (bsc#1234808)
      - CVE-2024-56326: Fixed sandbox breakout through indirect reference to format method (bsc#1234809)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
215191	RHEL 8 / 9 : OpenShift Container Platform 4.16.33 (RHSA-2025:0830)	Nessus	Red Hat Local Security Checks	medium
215105	RHEL 9 : OpenShift Container Platform 4.14.46 (RHSA-2025:0842)	Nessus	Red Hat Local Security Checks	medium
215092	RHEL 9 : OpenShift Container Platform 4.12.72 (RHSA-2025:0834)	Nessus	Red Hat Local Security Checks	medium
214801	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Jinja2 vulnerabilities (USN-7244-1)	Nessus	Ubuntu Local Security Checks	medium
214718	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2025:0777)	Nessus	Red Hat Local Security Checks	medium
214710	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Important) (RHSA-2025:0721)	Nessus	Red Hat Local Security Checks	medium
214706	RHEL 9 : OpenShift Container Platform 4.17.14 (RHSA-2025:0656)	Nessus	Red Hat Local Security Checks	medium
214603	Amazon Linux 2023 : ansible-core, ansible-test (ALAS2023-2025-811)	Nessus	Amazon Linux Local Security Checks	medium
214449	Fedora 40 : python-jinja2 (2025-6ed1e0c3c6)	Nessus	Fedora Local Security Checks	medium
214300	Fedora 40 : mingw-python-jinja2 (2025-5f04326f4f)	Nessus	Fedora Local Security Checks	medium
214289	Fedora 41 : mingw-python-jinja2 (2025-dbe19a2b1f)	Nessus	Fedora Local Security Checks	medium
214260	Oracle Linux 9 : fence-agents (ELSA-2025-0308)	Nessus	Oracle Linux Local Security Checks	medium
214244	CBL Mariner 2.0 Security Update: python-jinja2 (CVE-2024-56201)	Nessus	MarinerOS Local Security Checks	medium
214239	RHEL 9 : fence-agents (RHSA-2025:0345)	Nessus	Red Hat Local Security Checks	medium
214231	RHEL 9 : fence-agents (RHSA-2025:0335)	Nessus	Red Hat Local Security Checks	medium
214229	RHEL 9 : fence-agents (RHSA-2025:0338)	Nessus	Red Hat Local Security Checks	medium
214227	AlmaLinux 9 : fence-agents (ALSA-2025:0308)	Nessus	Alma Linux Local Security Checks	medium
214100	RHEL 9 : fence-agents (RHSA-2025:0308)	Nessus	Red Hat Local Security Checks	medium
213993	Fedora 41 : python-jinja2 (2025-7b6e208ef2)	Nessus	Fedora Local Security Checks	medium
213487	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Jinja2 (SUSE-SU-2025:0006-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-56201

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium