PT-2014-3433 · Pallets+2 · Jinja2+2

Thoger · Published 2014-05-19 · Updated 2024-06-15 · CVE-2014-0012

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jinja2 version 2.7.2 Jinja2 versions prior to 2.7.2

Description The FileSystemBytecodeCache in Jinja2 does not properly create temporary directories, allowing local users to gain privileges by pre-creating a temporary directory with a user's uid. This issue exists due to an incomplete fix for a previous problem.

Recommendations For Jinja2 version 2.7.2, update to a version that properly fixes the temporary directory creation issue. For Jinja2 versions prior to 2.7.2, update to version 2.7.2 or later to ensure proper temporary directory creation. As a temporary workaround, consider restricting access to the FileSystemBytecodeCache to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-377

CWE-264

Related Identifiers

ALT-PU-2020-3106

ALT-PU-2024-3036

CVE-2014-0012

GHSA-FQH9-2QGG-H84H

OPENSUSE-SU-2016_2465-1

OPENSUSE-SU-2019:0244-1

OPENSUSE-SU-2024:10129-1

OPENSUSE-SU-2024:11208-1

OPENSUSE-SU-2024:13930-1

PYSEC-2014-82

SUSE-FU-2022:0444-1

SUSE-FU-2022:0445-1

SUSE-SU-2015:1336-1

USN-2301-1

Affected Products

Alt Linux

Jinja2

Suse

References · 51

• 🔥 https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1402 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22195 · Security Note
• https://errata.altlinux.org/ALT-PU-2020-3106 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-0012 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2301-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00884 · Security Note
• https://ubuntu.com/security/CVE-2014-0012 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10129-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0012 · Security Note
• http://gentoo.org/security/en/glsa/glsa-201408-13.xml · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-82 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:0244-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01179 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-0012 · Vendor Advisory