Jinja2 Template Injection Vulnerability Affects JumpServer's Ansible

CVE-2024-29202

What is CVE-2024-29202?

JumpServer, an open source bastion host and operation maintenance security audit system, is affected by a Jinja2 template injection vulnerability in its Ansible component. This flaw allows attackers to execute arbitrary code within the Celery container, which operates with root privileges. Consequently, this opens a pathway for malicious actors to gain unauthorized access to sensitive information across all connected hosts or to manipulate the underlying database systems. The vulnerability has been addressed in version 3.10.7, providing critical patches to enhance the security posture of the JumpServer ecosystem.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

News Articles

CybersecurityNews

CVE-2024-29201CVE-2024-29202

JumpServer Critical Flaws Let Attackers Execute Arbitrary Code Remotely

The critical vulnerabilities in JumpServer's Ansible that allowed attackers to execute arbitrary remote code have been patched.

References