CVE catalog

CVE-2016-10745

jinja2: CVE-2016-10745

[CVE catalog]

Severity
Critical · CVSS 9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
3.52% · Oct 25, 2026

In Pallets Jinja before 2.8.1, str.format allows a sandbox escape.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjinja2sid3.1.6-4fixed
Debianjinja2forky3.1.6-4fixed
Debianjinja2trixie3.1.6-1fixed
Debianjinja2bookworm3.1.2-1+deb12u3fixed
Ubuntujinja216.042.8-1vulnerable
Ubuntujinja216.042.8-1ubuntu0.1fixed
Ubuntujinja218.042.9.6-1vulnerable
Ubuntujinja218.042.10-1vulnerable
Ubuntujinja218.042.10-1ubuntu0.18.04.1fixed
Ubuntujinja2pro2.7-3vulnerable
Ubuntujinja2pro2.7.1-1vulnerable
Ubuntujinja2pro2.7.2-1vulnerable
Ubuntujinja2pro2.7.2-2vulnerable
Ubuntujinja2pro2.7.2-2ubuntu0.1~esm1fixed
Susepython-Jinja2linux enterprise module for basesystem 152.10.1-3.5.1fixed
Susepython-Jinja2openstack cloud 72.8-22.8.1fixed
Susepython-Jinja2linux enterprise point of sale 12 sp22.8-22.8.1fixed
Susepython-Jinja2manager proxy 3.12.8-22.8.1fixed
Susepython-Jinja2manager proxy 3.22.8-22.8.1fixed
Susepython-Jinja2manager server 3.12.8-22.8.1fixed
Susepython-Jinja2manager server 3.22.8-22.8.1fixed
Susepython-Jinja2enterprise storage 42.8-22.8.1fixed
Susepython-Jinja2enterprise storage 52.8-22.8.1fixed
Susepython-Jinja2manager client tools 122.8-19.17.1fixed
Susepython-Jinja2linux enterprise module for advanced systems management 122.8-19.17.1fixed
Susepython-Jinja2linux enterprise module for public cloud 122.8-19.17.1fixed
Suseardana-cassandraopenstack cloud 99.0+git.1600802664.7e480a2-3.6.2fixed
Suseardana-mqopenstack cloud 99.0+git.1605174486.a78ddce-3.19.2fixed
Suseardana-osconfigopenstack cloud 99.0+git.1601621747.a87e5a0-3.22.2fixed
Suseardana-tempestopenstack cloud 99.0+git.1603378983.fc0bca9-3.19.2fixed
Susegrafanaopenstack cloud 96.7.4-3.20.1fixed
Suseinfluxdbopenstack cloud 91.3.8-4.3.3fixed
Suseopenstack-cinderopenstack cloud 913.0.10~dev20-3.28.2fixed
Suseopenstack-heatopenstack cloud 911.0.4~dev4-3.19.2fixed
Suseopenstack-heat-gbpopenstack cloud 912.0.1~dev2-3.3.4fixed
Suseopenstack-heat-templatesopenstack cloud 90.0.0+git.1605509190.64f020b6-3.9.3fixed
Suseopenstack-horizon-plugin-gbp-uiopenstack cloud 912.0.1~dev3-3.3.4fixed
Suseopenstack-ironic-python-agentopenstack cloud 93.3.4~dev6-3.19.4fixed
Suseopenstack-manilaopenstack cloud 97.4.2~dev57-4.30.2fixed
Suseopenstack-neutronopenstack cloud 913.0.8~dev135-3.31.2fixed
Suseopenstack-neutron-gbpopenstack cloud 912.0.1~dev5-3.19.4fixed
Suseopenstack-neutron-vpnaasopenstack cloud 913.0.2~dev6-3.9.2fixed
Suseopenstack-novaopenstack cloud 918.3.1~dev77-3.31.2fixed
Susepython-Jinja2openstack cloud 92.10.1-3.3.3fixed
Susepython-pysaml2openstack cloud 94.5.0-4.3.3fixed
Susepython-pytestopenstack cloud 93.7.4-3.3.3fixed
Susepython-urllib3openstack cloud 91.23-3.15.3fixed
Suserelease-notes-suse-openstack-cloudopenstack cloud 99.20200917-3.24.3fixed
Susesparkopenstack cloud 92.2.3-5.3.3fixed
Susevenv-openstack-barbicanopenstack cloud 97.0.1~dev24-3.21.2fixed
Susevenv-openstack-cinderopenstack cloud 913.0.10~dev20-3.24.2fixed
Susevenv-openstack-designateopenstack cloud 97.0.2~dev2-3.21.2fixed
Susevenv-openstack-glanceopenstack cloud 917.0.1~dev30-3.19.2fixed
Susevenv-openstack-heatopenstack cloud 911.0.4~dev4-3.21.2fixed
Susevenv-openstack-horizonopenstack cloud 914.1.1~dev7-4.23.2fixed
Susevenv-openstack-ironicopenstack cloud 911.1.5~dev16-4.19.2fixed
Susevenv-openstack-keystoneopenstack cloud 914.2.1~dev4-3.21.2fixed
Susevenv-openstack-magnumopenstack cloud 97.2.1~dev1-4.21.2fixed
Susevenv-openstack-manilaopenstack cloud 97.4.2~dev57-3.25.2fixed
Susevenv-openstack-monascaopenstack cloud 92.7.1~dev10-3.19.2fixed
Susevenv-openstack-monasca-ceilometeropenstack cloud 91.8.2~dev3-3.21.2fixed
Susevenv-openstack-neutronopenstack cloud 913.0.8~dev135-6.23.2fixed
Susevenv-openstack-novaopenstack cloud 918.3.1~dev77-3.23.2fixed
Susevenv-openstack-octaviaopenstack cloud 93.2.3~dev7-4.21.2fixed
Susevenv-openstack-saharaopenstack cloud 99.0.2~dev15-3.21.2fixed
Susevenv-openstack-swiftopenstack cloud 92.19.2~dev48-2.16.2fixed
Susecrowbar-coreopenstack cloud crowbar 96.0+git.1606314264.bf9ada813-3.31.2fixed
Susecrowbar-openstackopenstack cloud crowbar 96.0+git.1604573541.bb18c172d-3.28.3fixed
Susegrafanaopenstack cloud crowbar 96.7.4-3.20.1fixed
Suseinfluxdbopenstack cloud crowbar 91.3.8-4.3.3fixed
Suseopenstack-cinderopenstack cloud crowbar 913.0.10~dev20-3.28.2fixed
Suseopenstack-heatopenstack cloud crowbar 911.0.4~dev4-3.19.2fixed
Suseopenstack-heat-gbpopenstack cloud crowbar 912.0.1~dev2-3.3.4fixed
Suseopenstack-heat-templatesopenstack cloud crowbar 90.0.0+git.1605509190.64f020b6-3.9.3fixed
Suseopenstack-horizon-plugin-gbp-uiopenstack cloud crowbar 912.0.1~dev3-3.3.4fixed
Suseopenstack-ironic-python-agentopenstack cloud crowbar 93.3.4~dev6-3.19.4fixed
Suseopenstack-manilaopenstack cloud crowbar 97.4.2~dev57-4.30.2fixed
Suseopenstack-neutronopenstack cloud crowbar 913.0.8~dev135-3.31.2fixed
Suseopenstack-neutron-gbpopenstack cloud crowbar 912.0.1~dev5-3.19.4fixed
Suseopenstack-neutron-vpnaasopenstack cloud crowbar 913.0.2~dev6-3.9.2fixed
Suseopenstack-novaopenstack cloud crowbar 918.3.1~dev77-3.31.2fixed
Susepython-Jinja2openstack cloud crowbar 92.10.1-3.3.3fixed
Susepython-pysaml2openstack cloud crowbar 94.5.0-4.3.3fixed
Susepython-pytestopenstack cloud crowbar 93.7.4-3.3.3fixed
Susepython-urllib3openstack cloud crowbar 91.23-3.15.3fixed
Suserelease-notes-suse-openstack-cloudopenstack cloud crowbar 99.20200917-3.24.3fixed
Susesparkopenstack cloud crowbar 92.2.3-5.3.3fixed
Opensusepython-Jinja2leap 15.02.10.1-lp150.2.3.1fixed
Ubuntujinja2pro2.7-3vulnerable
Ubuntujinja2pro2.7.1-1vulnerable
Ubuntujinja2pro2.7.2-1vulnerable
Ubuntujinja2pro2.7.2-2vulnerable
Ubuntujinja2pro2.7.2-2ubuntu0.1~esm1fixed
Ubuntujinja216.042.8-1vulnerable
Ubuntujinja216.042.8-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjinja2sourcesid2.9.4-1not yet assignedNot reportedNot reported
Debianjinja2sourceforky2.9.4-1not yet assignedNot reportedNot reported
Debianjinja2sourcetrixie2.9.4-1not yet assignedNot reportedNot reported
Debianjinja2sourcebookworm2.9.4-1not yet assignedNot reportedNot reported
Ubuntujinja2deb16.042.8-1ubuntu0.1Not reportedUSN-4011-1Not reported
Ubuntujinja2deb18.042.10-1ubuntu0.18.04.1Not reportedUSN-4011-1Not reported
Ubuntujinja2debpro2.7.2-2ubuntu0.1~esm1Not reportedUSN-4011-2Not reported
Susepython-Jinja2rpmlinux enterprise module for basesystem 152.10.1-3.5.1Not reportedSUSE-SU-2019:1156-1Not reported
Susepython-Jinja2rpmopenstack cloud 72.8-22.8.1Not reportedSUSE-SU-2019:1554-1Not reported
Susepython-Jinja2rpmlinux enterprise point of sale 12 sp22.8-22.8.1Not reportedSUSE-SU-2019:1554-1Not reported
Susepython-Jinja2rpmmanager proxy 3.12.8-22.8.1Not reportedSUSE-SU-2019:1554-1Not reported
Susepython-Jinja2rpmmanager proxy 3.22.8-22.8.1Not reportedSUSE-SU-2019:1554-1Not reported
Susepython-Jinja2rpmmanager server 3.12.8-22.8.1Not reportedSUSE-SU-2019:1554-1Not reported
Susepython-Jinja2rpmmanager server 3.22.8-22.8.1Not reportedSUSE-SU-2019:1554-1Not reported
Susepython-Jinja2rpmenterprise storage 42.8-22.8.1Not reportedSUSE-SU-2019:1554-1Not reported
Susepython-Jinja2rpmenterprise storage 52.8-22.8.1Not reportedSUSE-SU-2019:1554-1Not reported
Susepython-Jinja2rpmmanager client tools 122.8-19.17.1Not reportedSUSE-SU-2019:1323-1Not reported
Susepython-Jinja2rpmlinux enterprise module for advanced systems management 122.8-19.17.1Not reportedSUSE-SU-2019:1323-1Not reported
Susepython-Jinja2rpmlinux enterprise module for public cloud 122.8-19.17.1Not reportedSUSE-SU-2019:1323-1Not reported
Suseardana-cassandrarpmopenstack cloud 99.0+git.1600802664.7e480a2-3.6.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseardana-mqrpmopenstack cloud 99.0+git.1605174486.a78ddce-3.19.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseardana-osconfigrpmopenstack cloud 99.0+git.1601621747.a87e5a0-3.22.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseardana-tempestrpmopenstack cloud 99.0+git.1603378983.fc0bca9-3.19.2Not reportedSUSE-SU-2020:3897-1Not reported
Susegrafanarpmopenstack cloud 96.7.4-3.20.1Not reportedSUSE-SU-2020:3897-1Not reported
Suseinfluxdbrpmopenstack cloud 91.3.8-4.3.3Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-cinderrpmopenstack cloud 913.0.10~dev20-3.28.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-heatrpmopenstack cloud 911.0.4~dev4-3.19.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-heat-gbprpmopenstack cloud 912.0.1~dev2-3.3.4Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-heat-templatesrpmopenstack cloud 90.0.0+git.1605509190.64f020b6-3.9.3Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-horizon-plugin-gbp-uirpmopenstack cloud 912.0.1~dev3-3.3.4Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-ironic-python-agentrpmopenstack cloud 93.3.4~dev6-3.19.4Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-manilarpmopenstack cloud 97.4.2~dev57-4.30.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-neutronrpmopenstack cloud 913.0.8~dev135-3.31.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-neutron-gbprpmopenstack cloud 912.0.1~dev5-3.19.4Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-neutron-vpnaasrpmopenstack cloud 913.0.2~dev6-3.9.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-novarpmopenstack cloud 918.3.1~dev77-3.31.2Not reportedSUSE-SU-2020:3897-1Not reported
Susepython-Jinja2rpmopenstack cloud 92.10.1-3.3.3Not reportedSUSE-SU-2020:3897-1Not reported
Susepython-pysaml2rpmopenstack cloud 94.5.0-4.3.3Not reportedSUSE-SU-2020:3897-1Not reported
Susepython-pytestrpmopenstack cloud 93.7.4-3.3.3Not reportedSUSE-SU-2020:3897-1Not reported
Susepython-urllib3rpmopenstack cloud 91.23-3.15.3Not reportedSUSE-SU-2020:3897-1Not reported
Suserelease-notes-suse-openstack-cloudrpmopenstack cloud 99.20200917-3.24.3Not reportedSUSE-SU-2020:3897-1Not reported
Susesparkrpmopenstack cloud 92.2.3-5.3.3Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-barbicanrpmopenstack cloud 97.0.1~dev24-3.21.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-cinderrpmopenstack cloud 913.0.10~dev20-3.24.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-designaterpmopenstack cloud 97.0.2~dev2-3.21.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-glancerpmopenstack cloud 917.0.1~dev30-3.19.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-heatrpmopenstack cloud 911.0.4~dev4-3.21.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-horizonrpmopenstack cloud 914.1.1~dev7-4.23.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-ironicrpmopenstack cloud 911.1.5~dev16-4.19.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-keystonerpmopenstack cloud 914.2.1~dev4-3.21.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-magnumrpmopenstack cloud 97.2.1~dev1-4.21.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-manilarpmopenstack cloud 97.4.2~dev57-3.25.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-monascarpmopenstack cloud 92.7.1~dev10-3.19.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-monasca-ceilometerrpmopenstack cloud 91.8.2~dev3-3.21.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-neutronrpmopenstack cloud 913.0.8~dev135-6.23.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-novarpmopenstack cloud 918.3.1~dev77-3.23.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-octaviarpmopenstack cloud 93.2.3~dev7-4.21.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-sahararpmopenstack cloud 99.0.2~dev15-3.21.2Not reportedSUSE-SU-2020:3897-1Not reported
Susevenv-openstack-swiftrpmopenstack cloud 92.19.2~dev48-2.16.2Not reportedSUSE-SU-2020:3897-1Not reported
Susecrowbar-corerpmopenstack cloud crowbar 96.0+git.1606314264.bf9ada813-3.31.2Not reportedSUSE-SU-2020:3897-1Not reported
Susecrowbar-openstackrpmopenstack cloud crowbar 96.0+git.1604573541.bb18c172d-3.28.3Not reportedSUSE-SU-2020:3897-1Not reported
Susegrafanarpmopenstack cloud crowbar 96.7.4-3.20.1Not reportedSUSE-SU-2020:3897-1Not reported
Suseinfluxdbrpmopenstack cloud crowbar 91.3.8-4.3.3Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-cinderrpmopenstack cloud crowbar 913.0.10~dev20-3.28.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-heatrpmopenstack cloud crowbar 911.0.4~dev4-3.19.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-heat-gbprpmopenstack cloud crowbar 912.0.1~dev2-3.3.4Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-heat-templatesrpmopenstack cloud crowbar 90.0.0+git.1605509190.64f020b6-3.9.3Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-horizon-plugin-gbp-uirpmopenstack cloud crowbar 912.0.1~dev3-3.3.4Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-ironic-python-agentrpmopenstack cloud crowbar 93.3.4~dev6-3.19.4Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-manilarpmopenstack cloud crowbar 97.4.2~dev57-4.30.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-neutronrpmopenstack cloud crowbar 913.0.8~dev135-3.31.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-neutron-gbprpmopenstack cloud crowbar 912.0.1~dev5-3.19.4Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-neutron-vpnaasrpmopenstack cloud crowbar 913.0.2~dev6-3.9.2Not reportedSUSE-SU-2020:3897-1Not reported
Suseopenstack-novarpmopenstack cloud crowbar 918.3.1~dev77-3.31.2Not reportedSUSE-SU-2020:3897-1Not reported
Susepython-Jinja2rpmopenstack cloud crowbar 92.10.1-3.3.3Not reportedSUSE-SU-2020:3897-1Not reported
Susepython-pysaml2rpmopenstack cloud crowbar 94.5.0-4.3.3Not reportedSUSE-SU-2020:3897-1Not reported
Susepython-pytestrpmopenstack cloud crowbar 93.7.4-3.3.3Not reportedSUSE-SU-2020:3897-1Not reported
Susepython-urllib3rpmopenstack cloud crowbar 91.23-3.15.3Not reportedSUSE-SU-2020:3897-1Not reported
Suserelease-notes-suse-openstack-cloudrpmopenstack cloud crowbar 99.20200917-3.24.3Not reportedSUSE-SU-2020:3897-1Not reported
Susesparkrpmopenstack cloud crowbar 92.2.3-5.3.3Not reportedSUSE-SU-2020:3897-1Not reported
Opensusepython-Jinja2rpmleap 15.02.10.1-lp150.2.3.1Not reportedOPENSUSE-SU-2019:1395-1Not reported
Ubuntujinja2debpro2.7.2-2ubuntu0.1~esm1Not reportedUBUNTU-CVE-2016-10745Not reported
Ubuntujinja2deb16.042.8-1ubuntu0.1Not reportedUBUNTU-CVE-2016-10745Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • Source package: [jinja2]

    Details (2)
    • 3.1.2-1+deb12u3 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · jinja2 · debian · bookworm; dsa · jinja2 · debian · 12

    • 3.1.2-1+deb12u3 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · jinja2 · debian · bookworm; dsa · jinja2 · debian · 12

  • Source package: [jinja2]

    Details (2)
    • 3.1.2-1+deb12u3 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · jinja2 · debian · bookworm; dsa · jinja2 · debian · 12

    • 3.1.2-1+deb12u3 · all · bookworm

      Fixed · Fixed: 2.9.4-1

      dsa · jinja2 · debian · bookworm; dsa · jinja2 · debian · 12

[Debian 13 (Trixie)]

  • Source package: [jinja2]

    Details (2)
    • 3.1.6-1 · all · trixie

      Fixed · Fixed: 2.9.4-1

      dsa · jinja2 · debian · 13

    • 3.1.6-1 · all · trixie

      Fixed · Fixed: 2.9.4-1

      dsa · jinja2 · debian · 13

  • Source package: [jinja2]

    Details (2)
    • 3.1.6-1 · all · trixie

      Fixed · Fixed: 2.9.4-1

      dsa · jinja2 · debian · 13

    • 3.1.6-1 · all · trixie

      Fixed · Fixed: 2.9.4-1

      dsa · jinja2 · debian · 13

Observed:

References