ALPINE-CVE-2020-28493
Record from OSV · Published February 1, 2021
This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| py3-jinja2 | Alpine:v3.16 | 1.11.3-r0 |
| py3-jinja2 | Alpine:v3.22 | 1.11.3-r0 |
| py3-jinja2 | Alpine:v3.14 | 1.11.3-r0 |
| py3-jinja2 | Alpine:v3.17 | 1.11.3-r0 |
| py3-jinja2 | Alpine:v3.24 | 1.11.3-r0 |
| py3-jinja2 | Alpine:v3.15 | 1.11.3-r0 |
| py3-jinja2 | Alpine:v3.21 | 1.11.3-r0 |
| py3-jinja2 | Alpine:v3.20 | 1.11.3-r0 |
| py3-jinja2 | Alpine:v3.23 | 1.11.3-r0 |
| py3-jinja2 | Alpine:v3.19 | 1.11.3-r0 |
| py3-jinja2 | Alpine:v3.18 | 1.11.3-r0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.16 | py3-jinja2 | 0 |
| Alpine:v3.22 | py3-jinja2 | 0 |
| Alpine:v3.14 | py3-jinja2 | 0 |
| Alpine:v3.17 | py3-jinja2 | 0 |
| Alpine:v3.24 | py3-jinja2 | 0 |
| Alpine:v3.15 | py3-jinja2 | 0 |
| Alpine:v3.21 | py3-jinja2 | 0 |
| Alpine:v3.20 | py3-jinja2 | 0 |
| Alpine:v3.23 | py3-jinja2 | 0 |
| Alpine:v3.19 | py3-jinja2 | 0 |
| Alpine:v3.18 | py3-jinja2 | 0 |
Timeline
- Feb 1, 2021 CVE Published
- Aug 5, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln ALPINE-CVE-2020-28493
vulnetix vdb fixes ALPINE-CVE-2020-28493Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/ALPINE-CVE-2020-28493/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart