—

PYSEC-2014-82

Quick fix

PYSEC-2014-82 — jinja2: upgrade to the fixed version with the command below.

pip install --upgrade 'jinja2>=acb672b6a179567632e032f547582f30fa2f4aa7'

Details

FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/jinja2

Introduced in: 0Fixed in: acb672b6a179567632e032f547582f30fa2f4aa7

Fixpip install --upgrade 'jinja2>=acb672b6a179567632e032f547582f30fa2f4aa7'

References

https://bugzilla.redhat.com/show_bug.cgi?id=1051421[REPORT]
https://github.com/mitsuhiko/jinja2/pull/292[WEB]
https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7[FIX]
http://seclists.org/oss-sec/2014/q1/73[WEB]
https://github.com/mitsuhiko/jinja2/pull/296[WEB]
http://secunia.com/advisories/60738[ADVISORY]
http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml[WEB]
http://secunia.com/advisories/56328[ADVISORY]
https://github.com/advisories/GHSA-fqh9-2qgg-h84h[ADVISORY]