未評価
In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja do...
CVE-2021-44657
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default.
参照URL
- advisory stackstorm.com
- patch github.com
- report github.com
- report podalirius.net