Incorrect Privilege Assignment in Jinja2

MEDIO 4.4CVE-2014-1402 · GHSA-8r7q-cvjq-x353 · PYSEC-2014-8 · Published 19/05/2014 · updated 17/06/2026

En resumen

CVE-2014-1402 es una vulnerabilidad MEDIO (CVSS 4.4) que afecta a jinja2, jinja2 (pocoo).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.38%, mayor que el 31.6% de las vulnerabilidades.
Solución: actualizar a 2.7.2 o posterior.

Package	Affected versions	Patched versions
jinja2 PyPI	`< 2.7.2`	`2.7.2`
jinja2 pocoo	`= 2.0= 2.1= 2.1.1= 2.2= 2.2.1= 2.3= 2.3.1= 2.4= 2.4.1= 2.5= 2.5.1= 2.5.2= 2.5.3= 2.5.4= 2.5.5= 2.6= 2.7≤ 2.7.1`	No fix yet

Description

The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.

NVD description

The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.