Skip to content
Fencer Vulns
medium 5.3

CVE-2020-28493 json

Regular Expression Denial of Service (ReDoS)

published 2021-02-01 5 y ago modified 2026-06-17 4 mo ago also GHSA-g3rq-g295-4j3m , PYSEC-2021-66 , EUVD-2021-0103

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.6%
EPSS 3.6% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

Patch / fix

  • pypi jinja2 2.11.3
  • n/a jinja2 2.11.3
  • jinja2 Debian 14, Debian 13, Debian 12 2.11.3-1

debian advisories DEBIAN-CVE-2020-28493

  • jinja2 Ubuntu 20.04 LTS 2.10.1-2ubuntu0.2
  • jinja2 Ubuntu Pro 14.04 LTS 2.7.2-2ubuntu0.1~esm2
  • jinja2 Ubuntu Pro 16.04 LTS 2.8-1ubuntu0.1+esm1
  • jinja2 Ubuntu Pro 18.04 LTS 2.10-1ubuntu0.18.04.1+esm1

ubuntu advisories UBUNTU-CVE-2020-28493

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • pytz RHEL 8 2019.3-3.module+el8.4.0+8888+89bc7e79
  • babel RHEL 8 2.7.0-11.module+el8.5.0+11015+9c1c7c42
  • numpy RHEL 8 1.17.3-6.module+el8.5.0+12205+a865257a
  • scipy RHEL 8 1.3.1-4.module+el8.4.0+8888+89bc7e79
  • Cython RHEL 8 0.29.14-4.module+el8.4.0+8888+89bc7e79
  • pytest RHEL 8 4.6.6-3.module+el8.4.0+8888+89bc7e79
  • PyYAML RHEL 8 5.4.1-1.module+el8.5.0+10721+14d8e0d5
  • mod_wsgi RHEL 8 4.6.8-3.module+el8.4.0+8888+89bc7e79

red hat advisories RHSA-2021:4162RHSA-2021:4151RHSA-2021:3252RHSA-2021:3254RHSA-2021:4161

  • python-Jinja2 SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +12 more 2.10.1-3.10.2
  • python-Jinja2 SLE Module for Public Cloud 12, SLE Module for Advanced Systems Management 12, Manager Client Tools 12 2.8-19.23.1
  • python-Jinja2 SLES 11-PUBCLOUD, SLES 11 SP4-CLIENT-TOOLS, SLES 11 SP3-CLIENT-TOOLS 2.6-2.19.5.1
  • python-Jinja2 OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 2.9.6-3.6.1
  • python-Jinja2 OpenStack Cloud Crowbar 9, OpenStack Cloud 9 2.10.1-3.6.1
  • python-Jinja2 SLE Point of Sale 12 SP2, OpenStack Cloud 7 2.8-22.11.1

suse advisories SUSE-SU-2021:0654-1SUSE-SU-2021:0607-1SUSE-SU-2021:14644-1SUSE-SU-2021:0603-1SUSE-SU-2021:0602-1SUSE-SU-2021:0601-1

  • python-Jinja2 openSUSE Tumbleweed 3.1.6-2.4
  • python-Jinja2 openSUSE Tumbleweed 3.0.1-3.2
  • python-Jinja2 openSUSE Tumbleweed 3.1.4-1.1

opensuse advisories openSUSE-SU-2026:11992-1openSUSE-SU-2024:11208-1openSUSE-SU-2024:13930-1

  • python38-py AlmaLinux 8 1.8.0-8.module_el8.6.0+2778+cd494b30
  • python38-ply AlmaLinux 8 3.11-10.module_el8.6.0+2778+cd494b30
  • python38-six AlmaLinux 8 1.12.0-10.module_el8.6.0+2778+cd494b30
  • python38-cffi AlmaLinux 8 1.13.2-3.module_el8.6.0+2778+cd494b30
  • python38-idna AlmaLinux 8 2.8-6.module_el8.6.0+2778+cd494b30
  • python38-pytz AlmaLinux 8 2019.3-3.module_el8.6.0+2778+cd494b30
  • python38-attrs AlmaLinux 8 19.3.0-3.module_el8.6.0+2778+cd494b30
  • python38-babel AlmaLinux 8 2.7.0-11.module_el8.6.0+2778+cd494b30

almalinux advisories ALSA-2021:4162ALSA-2021:4161ALSA-2021:4151

  • pytz Rocky Linux 8 2019.3-3.module+el8.4.0+570+c2eaf144
  • babel Rocky Linux 8 2.7.0-11.module+el8.5.0+672+ab6eb015
  • numpy Rocky Linux 8 1.17.3-6.module+el8.5.0+672+ab6eb015
  • scipy Rocky Linux 8 1.3.1-4.module+el8.5.0+672+ab6eb015
  • scipy Rocky Linux 8 1.3.1-4.module+el8.4.0+570+c2eaf144
  • Cython Rocky Linux 8 0.29.14-4.module+el8.4.0+570+c2eaf144
  • pytest Rocky Linux 8 4.6.6-3.module+el8.4.0+570+c2eaf144
  • PyYAML Rocky Linux 8 5.4.1-1.module+el8.5.0+672+ab6eb015

rocky linux advisories RLSA-2021:4162RLSA-2021:4161RLSA-2021:4151

  • py3-jinja2 Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.11.3-r0

alpine advisories ALPINE-CVE-2020-28493

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nodejs Azure Linux 3.0 20.14.0-1
  • nodejs24 Azure Linux 3.0 24.13.0-1

azure linux advisories AZL-40857AZL-75813

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • python-jinja Arch Linux 2.11.3-1

arch linux advisories AVG-1523

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-28493 updated cvss 7.5

python-jinja2: ReDoS vulnerability in the urlize filter

  • Red Hat Ceph Storage 2 python-jinja2 Red Hat Ceph Storage 3 python-jinja2 Red Hat Enterprise Linux 6 python-jinja2 Red Hat Enterprise Linux 7 python-jinja2 Red Hat OpenStack Platform 13 (Queens) python2-jinja2
    affected: workaround, no fix planned “If using the jinja2 library as a developer, this flaw can be mitigated by not using the vulnerable urlize() filter, and instead, using Markdown to format user content.”
  • Red Hat Quay 3 quay/quay-rhel8 Red Hat Satellite 6 python-jinja2, python2-jinja2
    affected: workaround, no fix available “If using the jinja2 library as a developer, this flaw can be mitigated by not using the vulnerable urlize() filter, and instead, using Markdown to format user content.”
  • Red Hat CodeReady Linux Builder (v. 8) pytest 4.6.6-3.module+el8.4.0+8888+89bc7e79, python-py 1.8.0-8.module+el8.4.0+8888+89bc7e79, python38-py 1.8.0-8.module+el8.4.0+8888+89bc7e79, python-attrs 19.3.0-3.module+el8.4.0+8888+89bc7e79, python-pluggy 0.13.0-3.module+el8.4.0+8888+89bc7e79, python-packaging 19.2-3.module+el8.4.0+8888+89bc7e79, +12 more
    fixed: vendor fix “If using the jinja2 library as a developer, this flaw can be mitigated by not using the vulnerable urlize() filter, and instead, using Markdown to format user content.” RHSA-2021:4162
  • Red Hat Enterprise Linux AppStream (v. 8) python-jinja2 2.10.1-3.el8, python3-jinja2 2.10.1-3.el8, pytz 2019.3-3.module+el8.4.0+8888+89bc7e79, scipy 1.3.1-4.module+el8.4.0+8888+89bc7e79, pytz 2017.2-12.module+el8.1.0+3111+de3f2d8e, PyYAML 3.12-16.module+el8.1.0+3111+de3f2d8e, +150 more
    fixed: vendor fix “If using the jinja2 library as a developer, this flaw can be mitigated by not using the vulnerable urlize() filter, and instead, using Markdown to format user content.” RHSA-2021:4151
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-babel 0.9.6-10.el7, python27-python 2.7.18-3.el7, python27-tkinter 2.7.18-3.el7, rh-python38-babel 2.7.0-12.el7, rh-python38-python 3.8.11-2.el7, python27-python-jinja2 2.6-16.el7, +18 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) python27-babel 0.9.6-10.el7, python27-python 2.7.18-3.el7, python27-tkinter 2.7.18-3.el7, rh-python38-babel 2.7.0-12.el7, rh-python38-python 3.8.11-2.el7, python27-python-jinja2 2.6-16.el7, +18 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-babel 0.9.6-10.el7, python27-python 2.7.18-3.el7, python27-tkinter 2.7.18-3.el7, rh-python38-babel 2.7.0-12.el7, rh-python38-python 3.8.11-2.el7, python27-python-jinja2 2.6-16.el7, +18 more
    fixed: vendor fix “If using the jinja2 library as a developer, this flaw can be mitigated by not using the vulnerable urlize() filter, and instead, using Markdown to format user content.” RHSA-2021:3252
  • Red Hat Ansible Automation Platform 1.2 jinja2, python-jinja2 Red Hat Ansible Tower 3 jinja2 Red Hat Enterprise Linux 9 python-jinja2, python3-jinja2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.59% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • snyk.io https://snyk.io/vuln/SNYK-PYTHON-JINJA2-1012994 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
pypi jinja2
<2.11.3
2.11.3

Affected products

  • n/a jinja2

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.