CVE-2014-1402

Publication date 19 May 2014

Last updated 24 July 2024

Ubuntu priority

The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
jinja2	14.04 LTS trusty	Not affected
	13.10 saucy	Ignored end of life
	13.04 raring	Ignored end of life
	12.10 quantal	Ignored end of life
	12.04 LTS precise	Fixed 2.6-1ubuntu0.1
	10.04 LTS lucid	Ignored end of life

Notes

mdeslaur

upstream commit below included in 2.7.2 introduces a temp file issue, which is CVE-2014-0012

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
jinja2	Upstream: acb672b

References

Related Ubuntu Security Notices (USN)

USN-2301-1
Jinja2 vulnerabilities
24 July 2014

Other references

https://www.cve.org/CVERecord?id=CVE-2014-1402