Jinja2 Incomplete Fix Insecure File Permissions Vulnerability

Bugtraq ID:	64787
Class:	Design Error
CVE:	CVE-2014-0012
Remote:	No
Local:	Yes
Published:	Jan 11 2014 12:00AM
Updated:	Oct 26 2016 11:02AM
Credit:	Arun Babu Neelicattu of Red Hat
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 S.u.S.E. openSUSE 13.2 Python Software Foundation Jinja2 2.7.2 Python Software Foundation Jinja2 2.7.1 Gentoo Linux
Not Vulnerable:

Jinja2 Incomplete Fix Insecure File Permissions Vulnerability

Jinja2 is prone to an insecure file-permission vulnerability.



A local attacker can exploit this issue to execute arbitrary code in the context of another user. This may aid in further attacks.



Note: This issue is the result of an incomplete fix for the issue described in BID 64759 (Jinja2 'jinja2.bccache.FileSystemBytecodeCache' Insecure File Permissions Vulnerability).

Jinja2 Incomplete Fix Insecure File Permissions Vulnerability

An attacker requires local, interactive access to the affected application to exploit this issue.

Jinja2 Incomplete Fix Insecure File Permissions Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Jinja2 Incomplete Fix Insecure File Permissions Vulnerability

References:

• Creating temporary files securely (Kurt Seifried)
  
• Fixed a security issue with temporary files on the filesystem cache (mitsuhiko)
  
• Jinja2 Homepage (Python Software Foundation)
  
• jinja2.bccache.FileSystemBytecodeCache: insecure default directory (Jakub Wilk)
  
• Re: CVE assignment for jinja2 (Vincent Danen)