HTML attribute injection when passing user input as keys to xmlattr filter
CVE: CVE-2024-22195
Component: jinja2
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2024-01-11T00:00:00+00:00

A  cross-site scripting (XSS) flaw was found in Jinja2 due to the xmlattr filter allowing keys with spaces, contrary to XML/HTML attribute standards. If an application accepts user-input keys and renders them for other users, attackers can inject additional attributes, potentially leading to XSS. This misuse of the xmlattr filter enables the injection of arbitrary HTML attributes, bypassing auto-escaping and potentially circumventing attribute validation checks.

Statement: The identified issue is classified as moderate due to a cross-site scripting (XSS) vulnerability in Jinja2. This flaw arises from the xmlattr filter, which permits keys with spaces, contrary to XML/HTML attribute standards. In scenarios where an application accepts user-input keys and renders them for other users, attackers can exploit this vulnerability to inject additional attributes, potentially resulting in XSS attacks. The misuse of the xmlattr filter facilitates the injection of arbitrary HTML attributes, allowing attackers to bypass auto-escaping mechanisms and potentially evade attribute validation checks, posing a moderate security risk.

Remediation:
Red Hat Ansible Automation Platform
Red Hat Ansible Automation Platform
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For detailed instructions on how to apply this update, see:
https://access.redhat.com/documentation/en-us/red_hat_update_infrastructure/4/html/migrating_red_hat_update_infrastructure/assembly_upgrading-red-hat-update-infrastructure_migrating-red-hat-update-infrastructure

For other information, see the product documentation:
https://access.redhat.com/documentation/en-us/red_hat_update_infrastructure/4
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_and_updating_red_hat_satellite/index
For details on how to apply this update, refer to:
* For upgrading connected Satellite: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html-single/upgrading_connected_red_hat_satellite_to_6.15
* For upgrading disconnected Satellite: https://access.redhat.com/documentation/en-us/red_hat_satellite/6.15/html-single/upgrading_disconnected_red_hat_satellite_to_6.15
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/7

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all applications using Jinja2 must be restarted.
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all applications using Jinja2 must be restarted.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.