Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-ansible-core) security update
A moderate severity vulnerability (CVE-2024-22195) exists in the python-jinja2 package used in Red Hat Enterprise Linux 8 and 9. The issue involves HTML attribute injection when user input is passed as keys to the xmlattr filter in Jinja2 templates. This vulnerability could allow unintended HTML attribute injection in affected applications. Red Hat has released security updates for python-jinja2 to address this issue. Applying the update and restarting all applications using Jinja2 is required to mitigate the vulnerability.
AI Analysis
Technical Summary
The python-jinja2 package, a Python template engine used in Red Hat OpenStack Platform 17.1 and Red Hat Enterprise Linux 9, contains an HTML attribute injection vulnerability (CVE-2024-22195). This occurs when user-supplied input is passed as keys to the xmlattr filter, potentially allowing injection of malicious HTML attributes. Red Hat has issued security advisories RHSA-2024:2348 and RHSA-2024:2733 providing updated packages that fix this vulnerability. The fix requires updating the python-jinja2 package and restarting all applications that use Jinja2 templates to apply the patch.
Potential Impact
The vulnerability allows HTML attribute injection via user input in Jinja2 templates, which could lead to injection of malicious attributes in rendered HTML. This may impact applications using Jinja2 for templating by enabling injection attacks that could affect the integrity of rendered content. The severity is rated moderate by Red Hat. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated python-jinja2 packages that fix CVE-2024-22195. Users should apply the security updates provided in Red Hat Enterprise Linux 9 and Red Hat OpenStack Platform 17.1 as described in advisories RHSA-2024:2348 and RHSA-2024:2733. After applying the update, all applications using Jinja2 must be restarted for the fix to take effect. Refer to https://access.redhat.com/articles/11258 for detailed update instructions.
Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-ansible-core) security update
Description
A moderate severity vulnerability (CVE-2024-22195) exists in the python-jinja2 package used in Red Hat Enterprise Linux 8 and 9. The issue involves HTML attribute injection when user input is passed as keys to the xmlattr filter in Jinja2 templates. This vulnerability could allow unintended HTML attribute injection in affected applications. Red Hat has released security updates for python-jinja2 to address this issue. Applying the update and restarting all applications using Jinja2 is required to mitigate the vulnerability.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The python-jinja2 package, a Python template engine used in Red Hat OpenStack Platform 17.1 and Red Hat Enterprise Linux 9, contains an HTML attribute injection vulnerability (CVE-2024-22195). This occurs when user-supplied input is passed as keys to the xmlattr filter, potentially allowing injection of malicious HTML attributes. Red Hat has issued security advisories RHSA-2024:2348 and RHSA-2024:2733 providing updated packages that fix this vulnerability. The fix requires updating the python-jinja2 package and restarting all applications that use Jinja2 templates to apply the patch.
Potential Impact
The vulnerability allows HTML attribute injection via user input in Jinja2 templates, which could lead to injection of malicious attributes in rendered HTML. This may impact applications using Jinja2 for templating by enabling injection attacks that could affect the integrity of rendered content. The severity is rated moderate by Red Hat. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated python-jinja2 packages that fix CVE-2024-22195. Users should apply the security updates provided in Red Hat Enterprise Linux 9 and Red Hat OpenStack Platform 17.1 as described in advisories RHSA-2024:2348 and RHSA-2024:2733. After applying the update, all applications using Jinja2 must be restarted for the fix to take effect. Refer to https://access.redhat.com/articles/11258 for detailed update instructions.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:2733
- Cve Count
- 1
Threat ID: 6a1f4ea3e29bf47b500889d0
Added to database: 06/02/2026, 21:44:03 UTC
Last enriched: 08/16/2026, 18:47:04 UTC
Last updated: 09/10/2026, 19:36:47 UTC
Views: 101
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.