fkie_cve-2014-1402
Vulnerability from fkie_nvd
Published
2014-05-19 14:55
Modified
2025-04-12 10:46
Severity ?
Summary
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
References
cve@mitre.orghttp://advisories.mageia.org/MGASA-2014-0028.html
cve@mitre.orghttp://jinja.pocoo.org/docs/changelog/
cve@mitre.orghttp://openwall.com/lists/oss-security/2014/01/10/2
cve@mitre.orghttp://openwall.com/lists/oss-security/2014/01/10/3
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2014-0747.html
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2014-0748.html
cve@mitre.orghttp://secunia.com/advisories/56287
cve@mitre.orghttp://secunia.com/advisories/58783
cve@mitre.orghttp://secunia.com/advisories/58918
cve@mitre.orghttp://secunia.com/advisories/59017
cve@mitre.orghttp://secunia.com/advisories/60738
cve@mitre.orghttp://secunia.com/advisories/60770
cve@mitre.orghttp://www.gentoo.org/security/en/glsa/glsa-201408-13.xml
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2014:096
cve@mitre.orghttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=1051421
cve@mitre.orghttps://oss.oracle.com/pipermail/el-errata/2014-June/004192.html
af854a3a-2127-422b-91ae-364da2661108http://advisories.mageia.org/MGASA-2014-0028.html
af854a3a-2127-422b-91ae-364da2661108http://jinja.pocoo.org/docs/changelog/
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2014/01/10/2
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2014/01/10/3
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2014-0747.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2014-0748.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/56287
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/58783
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/58918
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/59017
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/60738
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/60770
af854a3a-2127-422b-91ae-364da2661108http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2014:096
af854a3a-2127-422b-91ae-364da2661108https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1051421
af854a3a-2127-422b-91ae-364da2661108https://oss.oracle.com/pipermail/el-errata/2014-June/004192.html
Impacted products
Vendor Product Version
pocoo jinja2 *
pocoo jinja2 2.0
pocoo jinja2 2.0
pocoo jinja2 2.1
pocoo jinja2 2.1.1
pocoo jinja2 2.2
pocoo jinja2 2.2.1
pocoo jinja2 2.3
pocoo jinja2 2.3.1
pocoo jinja2 2.4
pocoo jinja2 2.4.1
pocoo jinja2 2.5
pocoo jinja2 2.5.1
pocoo jinja2 2.5.2
pocoo jinja2 2.5.3
pocoo jinja2 2.5.4
pocoo jinja2 2.5.5
pocoo jinja2 2.6
pocoo jinja2 2.7


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C17F89C8-60E2-490D-ADDD-3A3C683DB5EC",
              "versionEndIncluding": "2.7.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "5962EB2E-DAEA-4A50-AFDB-162EEA220974",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "69E6866B-D562-426B-A4FF-C78EDD04D8D3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "46E4F0BF-0944-430D-BB84-B42E07F6C8A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D164D2AA-4534-48D5-A90F-47C736FC3E6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B1BD2C2-88EB-4D86-8832-71E25F545218",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BBE6DFCB-BE4D-4204-B666-D4D1EA2EA753",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "68085717-AA12-48C8-81AD-DA3ADB17B587",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D5F7F6E7-584C-4F63-B98B-B71D0F3FDB0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "923F1074-8DB4-454A-BED4-F9BDD080DCC2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5F020EA-89C9-4A36-A668-493143335391",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "4812CCD7-5A95-499A-BE99-DAD88EE14902",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4E4836B-3047-40A7-A60B-25EE0C7FB537",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "31D6EEDF-76C5-4A79-8035-60940E00E6F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "B95337AF-4991-4AAE-A9EA-BC881B094717",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB314640-C430-4B96-A31E-B98E6F7294F5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "471D23E6-02A3-4390-89F7-4342DA18E3D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "0443DF18-E8AB-461C-BE64-EE0C6F00EE71",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:pocoo:jinja2:2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "5173B0E3-F80C-4E9D-9487-CD849A93F258",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp."
    },
    {
      "lang": "es",
      "value": "La configuraci\u00f3n por defecto para bccache.FileSystemBytecodeCache en Jinja2 anterior a 2.7.2 no crea debidamente archivos temporales, lo que permite a usuarios locales ganar privilegios a trav\u00e9s de un archivo .cache manipulado con un nombre que empieza con __jinja2_ en /tmp."
    }
  ],
  "id": "CVE-2014-1402",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.4,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-05-19T14:55:11.517",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://advisories.mageia.org/MGASA-2014-0028.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://jinja.pocoo.org/docs/changelog/"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://openwall.com/lists/oss-security/2014/01/10/2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://openwall.com/lists/oss-security/2014/01/10/3"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0747.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0748.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/56287"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/58783"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/58918"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/59017"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/60738"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/60770"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:096"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051421"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oss.oracle.com/pipermail/el-errata/2014-June/004192.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://advisories.mageia.org/MGASA-2014-0028.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jinja.pocoo.org/docs/changelog/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://openwall.com/lists/oss-security/2014/01/10/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://openwall.com/lists/oss-security/2014/01/10/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0747.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-0748.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/56287"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/58783"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/58918"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/59017"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/60738"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/60770"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:096"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051421"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oss.oracle.com/pipermail/el-errata/2014-June/004192.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.