Insecure Defaults Affecting jinja2 package, versions [,2.7.2)
Threat Intelligence
EPSS
0.04% (12th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-JINJA2-40028
- published 10 Jan 2014
- disclosed 10 Jan 2014
- credit Unknown
Introduced: 10 Jan 2014
CVE-2014-1402 Open this link in a new tabHow to fix?
Upgrade to version 2.7.2 or greater.
Overview
Jinja2 is a small but fast and easy to use stand-alone template engine written in pure python.
Affected versions of this package are vulnerable to Insecure Defaults attacks.
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with jinja2 in /tmp.
References
CVSS Scores
version 3.1