FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local
    users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability
    exists because of an incomplete fix for CVE-2014-1402. (CVE-2014-0012)

This update for python-Jinja2 fixes the following issues :

Update to version 2.8 :

  - Added `target` parameter to urlize function.

  - Added support for `followsymlinks` to the file system     loader.

  - The truncate filter now counts the length.

  - Added equalto filter that helps with select filters.

  - Changed cache keys to use absolute file names if     available instead of load names.

  - Fixed loop length calculation for some iterators.

  - Changed how Jinja2 enforces strings to be native strings     in Python 2 to work when people break their default     encoding.

  - Added :func:`make_logging_undefined` which returns an     undefined object that logs failures into a logger.

  - If unmarshalling of cached data fails the template will     be reloaded now.

  - Implemented a block ``set`` tag.

  - Default cache size was incrased to 400 from a low 50.

  - Fixed ``is number`` test to accept long integers in all     Python versions.

  - Changed ``is number`` to accept Decimal as a number.

  - Added a check for default arguments followed by     non-default arguments. This change makes ``(% macro m(x,     y=1, z) %)...(% endmacro %)`` a syntax error. The     previous behavior for this code was broken anyway     (resulting in the default value being applied to `y`).

  - Add ability to use custom subclasses of     ``jinja2.compiler.CodeGenerator`` and     ``jinja2.runtime.Context`` by adding two new attributes     to the environment (`code_generator_class` and     `context_class`) (pull request ``#404``).

  - added support for context/environment/evalctx decorator     functions on the finalize callback of the environment.

  - escape query strings for urlencode properly. Previously     slashes were not escaped in that place.

  - Add 'base' parameter to 'int' filter.

  - Update to 2.7.3 (boo#858239, CVE-2014-0012)

The remote Solaris system is missing necessary patches to address security updates :

  - FileSystemBytecodeCache in Jinja2 2.7.2 does not     properly create temporary directories, which allows     local users to gain privileges by pre-creating a     temporary directory with a user's uid. NOTE: this     vulnerability exists because of an incomplete fix for     CVE-2014-1402. (CVE-2014-0012)

  - The default configuration for     bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2     does not properly create temporary files, which allows     local users to gain privileges via a crafted .cache file     with a name starting with __jinja2_ in /tmp.
    (CVE-2014-1402)

The remote host is affected by the vulnerability described in GLSA-201408-13 (Jinja2: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Jinja2. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could gain escalated privileges via a specially crafted       cache file or  pre-created temporary directory.
  Workaround :

    There is no known workaround at this time.

It was discovered that Jinja2 incorrectly handled temporary cache files and directories. A local attacker could use this issue to possibly gain privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
414651	SCA: security update for Jinja2 (GHSA-fqh9-2qgg-h84h)	Tenable Cloud Security	SCA Checks	Local	medium
414651	SCA: security update for Jinja2 (GHSA-fqh9-2qgg-h84h)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
93995	openSUSE Security Update : python-Jinja2 (openSUSE-2016-1159)	Nessus	SuSE Local Security Checks	Local	medium
80649	Oracle Solaris Third-Party Patch Update : jinja2 (multiple_vulnerabilities_in_jinja2)	Nessus	Solaris Local Security Checks	Local	medium
77457	GLSA-201408-13 : Jinja2: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	medium
76785	Ubuntu 12.04 LTS : jinja2 vulnerabilities (USN-2301-1)	Nessus	Ubuntu Local Security Checks	Local	medium

Detections

Analytics

CVE-2014-0012

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium