PYSEC-2014-8

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2014-8.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2014-8

Aliases

Published

2014-05-19T14:55:00Z

Modified

2023-11-08T03:57:34.512953Z

Summary

[none]

Details

The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with _jinja2 in /tmp.

References

Affected packages

PyPI / jinja2

Package

Name: jinja2; View open source insights on deps.dev
Purl: pkg:pypi/jinja2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.7.2

Affected versions

2.*

2.0rc1

2.0

2.1

2.1.1

2.2

2.2.1

2.3

2.3.1

2.4

2.4.1

2.5

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.6

2.7

2.7.1

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/jinja2/PYSEC-2014-8.yaml"