GitHub Advisoryadvisory · PyPI

GHSA-8r7q-cvjq-x353 Incorrect Privilege Assignment in Jinja2

HIGH Published 2022-05-14 Modified 2024-09-24 Official page ↗
Aliases
CVE-2014-1402
Ecosystem
PyPI
Packages
Jinja2
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-266
Reviewed
2022-07-07

Affected packages

• PyPI Jinja2: < 2.7.2 → fixed in 2.7.2

Description

The default configuration for `bccache.FileSystemBytecodeCache` in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with `__jinja2_` in `/tmp`.

Related

Alias · CVE (1)

  • CVE-2014-1402 The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows… vulnerability

Weakness · CWE (1)

  • CWE-266 Incorrect Privilege Assignment weakness

References