Loading story…
Red Hat released updated OpenShift Container Platform images and packages for versions 4.13.49 and 4.15.25 to remediate CVE-2024-34064, a moderate-severity Jinja2 attribute-injection flaw. The issue affects the xmlattr filter when an application passes attacker-controlled dictionary keys: keys containing spaces, /, >, or = can be interpreted as additional HTML or XML attributes, potentially enabling cross-site scripting (XSS) against users viewing the rendered page.
The flaw was not fully addressed by the prior fix for CVE-2024-22195, which blocked spaces but not other unsafe characters. Jinja 3.1.4 fixes CVE-2024-34064, although applications should not pass unvalidated user-controlled keys to xmlattr regardless of version; user-controlled values remain safe. Red Hat advised OpenShift 4.13 and 4.15 customers across RHEL 8 and RHEL 9 architectures to upgrade through their applicable release channels using the OpenShift CLI or web console.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Red Hat published Moderate-severity advisory RHSA-2024:6011 for OpenShift Container Platform 4.13.49. The release provides package and image updates that remediate CVE-2024-34064 across supported RHEL 8 and RHEL 9 architectures.
Red Hat published RHSA-2024:4958, a Moderate-severity advisory for OpenShift Container Platform 4.15.25. The updated packages and images remediate CVE-2024-34064 in Jinja2 for supported RHEL 8 and RHEL 9 deployments.
Red Hat published Moderate-severity advisory RHSA-2024:4616 for OpenShift Container Platform 4.16.4, providing packages that remediate CVE-2024-34064 in Jinja2 and CVE-2024-24788, a Go net-package flaw that can cause an infinite loop from a malformed DNS message. The update applies to OpenShift 4.16 deployments on supported RHEL 8 and RHEL 9 architectures.
Jinja fixed an attribute-injection vulnerability in the xmlattr filter in version 3.1.4. The flaw could allow attacker-controlled dictionary keys containing spaces, slashes, greater-than signs, or equals signs to inject HTML/XML attributes and potentially enable XSS.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **OpenShift Container Platform 4.13.55** to remediate two Important Jinja2 vulnerabilities, `CVE-2024-56201` and `CVE-2024-56326`, through advisory `RHSA-2025:1118`. The vulnerabilities affect Jinja versions before 3.1.5 and can allow arbitrary Python code execution despite Jinja's sandbox protections in applications that render untrusted templates. `CVE-2024-56201` requires an attacker to control both template content and its filename, while `CVE-2024-56326` requires a suitable application-defined filter that indirectly invokes a malicious string object's `str.format` method. Red Hat advised OpenShift 4.13 users to update affected packages and container images through their release channel across RHEL 8 and 9 deployments on x86_64, ppc64le, s390x, and aarch64; organizations should also restrict user-controlled template filenames to an approved set where applicable.
Aug 27, 2026
A moderate cross-site scripting vulnerability, **CVE-2024-34064**, affects Jinja2's `xmlattr` filter when applications pass unvalidated, user-controlled keys into the filter. Keys containing invalid HTML or XML attribute characters can inject additional attributes into rendered output, potentially allowing attacker-controlled script execution when another user views the affected page. Red Hat assigned the flaw a CVSS v3.1 score of 5.4 and noted that the preceding fix for CVE-2024-22195 blocked spaces but did not address other dangerous characters. The issue is an instance of **CWE-79**, improper neutralization of input during web-page generation. Organizations should apply vendor fixes, prevent untrusted input from being used as `xmlattr` keys, validate inputs against strict allowlists, and use context-appropriate output encoding. Successful XSS exploitation can enable session-cookie theft, account takeover, unauthorized actions, and exposure of sensitive data; HttpOnly cookies and web application firewalls provide additional defense in depth.
Aug 27, 2026
Red Hat released Important security updates for **OpenShift Jenkins** in Red Hat OpenShift Developer Tools and Services 4.12 and 4.15, remediating vulnerabilities in Jenkins plugins and bundled components. The updates address arbitrary file reads, path traversal, sandbox bypass, improper input sanitization, denial-of-service conditions, SSH prefix truncation, and a Go JSON unmarshaling infinite-loop flaw across `x86_64`, `s390x`, `ppc64le`, and `aarch64` deployments. The advisories also address **CVE-2024-22201**, a Jetty HTTP/2 TLS denial-of-service vulnerability that can leak file descriptors when TCP-congested connections time out, eventually preventing affected servers from accepting legitimate connections. Red Hat provided updated Jenkins 2.440.3 packages for OpenShift 4.12 and Jenkins `2.440.3.1718879390-3.el8` with updated plugin packages for 4.15; organizations should apply the applicable OpenShift Jenkins updates.
Aug 29, 2026