GitHub Advisoryadvisory · PyPI

GHSA-fqh9-2qgg-h84h Insecure Temporary File in Jinja2

MEDIUM Published 2022-05-17 Modified 2024-09-23 Official page ↗
Aliases
CVE-2014-0012
Ecosystem
PyPI
Packages
Jinja2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-377
Reviewed
2023-02-14

Affected packages

• PyPI Jinja2: < 2.7.2 → fixed in 2.7.2

Description

FileSystemBytecodeCache in Jinja2 prior to version 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2014-0012 FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by… vulnerability

References