PT-2014-4172 · Pallets+3 · Jinja2+3

Published 2014-01-24 · Updated 2024-03-25 · CVE-2014-1402

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jinja2 versions prior to 2.7.2

Description The default configuration for bccache.FileSystemBytecodeCache in Jinja2 does not properly create temporary files. This allows local users to gain privileges via a crafted .cache file with a name starting with jinja2 in /tmp.

Recommendations For versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp directory to minimize the risk of exploitation. Avoid using the bccache.FileSystemBytecodeCache with the default configuration until the issue is resolved.

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

CWE-264

Related Identifiers

ALT-PU-2020-3106

ALT-PU-2024-3036

CESA-2014_0747

CVE-2014-1402

GHSA-8R7Q-CVJQ-X353

MGASA-2014-0028

PYSEC-2014-8

RHSA-2014:0747

RHSA-2014:0748

RHSA-2014_0747

USN-2301-1

Affected Products

Alt Linux

Centos

Jinja2

Red Hat

References · 55

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1402 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22195 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1402 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-1402 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0028 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-1402 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-3106 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-1402 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2301-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1402 · Security Note
• https://bdu.fstec.ru/vul/2024-00884 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0748.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0747.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0028.html · Security Note