~ / search / GHSA-fqh9-2qgg-h84h

GHSA-fqh9-2qgg-h84h

Insecure Temporary File in Jinja2

Source: GitHub Advisory Database (reviewed) Moderate CVE-2014-0012

Packages

EcosystemPackageAffectedFixed in
PyPI Jinja2 < 2.7.2 2.7.2

Details

As written in the advisory (Markdown source, shown as plain text).

FileSystemBytecodeCache in Jinja2 prior to version 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.

References

External links from the advisory. They lead to third-party sites.