Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by pocoo
CVE-2021-42771 (GCVE-0-2021-42771)
Vulnerability from cvelistv5 – Published: 2021-10-20 20:05 – Updated: 2024-08-04 03:38
VLAI
Summary
Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://www.tenable.com/security/research/tra-2021-14 | x_refsource_MISC |
| https://github.com/python-babel/babel/pull/782 | x_refsource_MISC |
| https://lists.debian.org/debian-lts/2021/10/msg00… | x_refsource_MISC |
| https://lists.debian.org/debian-lts-announce/2021… | mailing-listx_refsource_MLIST |
| https://www.debian.org/security/2021/dsa-5018 | vendor-advisoryx_refsource_DEBIAN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:38:50.154Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.tenable.com/security/research/tra-2021-14"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/python-babel/babel/pull/782"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts/2021/10/msg00040.html"
},
{
"name": "[debian-lts-announce] 20211021 [SECURITY] [DLA 2790-1] python-babel security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html"
},
{
"name": "DSA-5018",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-5018"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-12-10T02:06:18.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.tenable.com/security/research/tra-2021-14"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/python-babel/babel/pull/782"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://lists.debian.org/debian-lts/2021/10/msg00040.html"
},
{
"name": "[debian-lts-announce] 20211021 [SECURITY] [DLA 2790-1] python-babel security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html"
},
{
"name": "DSA-5018",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2021/dsa-5018"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-42771",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.tenable.com/security/research/tra-2021-14",
"refsource": "MISC",
"url": "https://www.tenable.com/security/research/tra-2021-14"
},
{
"name": "https://github.com/python-babel/babel/pull/782",
"refsource": "MISC",
"url": "https://github.com/python-babel/babel/pull/782"
},
{
"name": "https://lists.debian.org/debian-lts/2021/10/msg00040.html",
"refsource": "MISC",
"url": "https://lists.debian.org/debian-lts/2021/10/msg00040.html"
},
{
"name": "[debian-lts-announce] 20211021 [SECURITY] [DLA 2790-1] python-babel security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html"
},
{
"name": "DSA-5018",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2021/dsa-5018"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-42771",
"datePublished": "2021-10-20T20:05:35.000Z",
"dateReserved": "2021-10-20T00:00:00.000Z",
"dateUpdated": "2024-08-04T03:38:50.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-8341 (GCVE-0-2019-8341)
Vulnerability from cvelistv5 – Published: 2019-02-15 07:00 – Updated: 2024-08-04 21:17 Disputed
VLAI
Summary
An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/JameelNabbo/Jinja2-Code-execution | x_refsource_MISC |
| https://www.exploit-db.com/exploits/46386/ | exploitx_refsource_EXPLOIT-DB |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| http://lists.opensuse.org/opensuse-security-annou… | vendor-advisoryx_refsource_SUSE |
| https://bugzilla.redhat.com/show_bug.cgi?id=1677653 | x_refsource_MISC |
| https://bugzilla.suse.com/show_bug.cgi?id=1125815 | x_refsource_CONFIRM |
Date Public
2019-02-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T21:17:30.550Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/JameelNabbo/Jinja2-Code-execution"
},
{
"name": "46386",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/46386/"
},
{
"name": "openSUSE-SU-2019:1395",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"name": "openSUSE-SU-2019:1614",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677653"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1125815"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-02-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the \"source\" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn\u0027t valid because users shouldn\u0027t use untrusted templates without sandboxing"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-06T14:51:25.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/JameelNabbo/Jinja2-Code-execution"
},
{
"name": "46386",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/46386/"
},
{
"name": "openSUSE-SU-2019:1395",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"name": "openSUSE-SU-2019:1614",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677653"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1125815"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-8341",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the \"source\" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn\u0027t valid because users shouldn\u0027t use untrusted templates without sandboxing."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/JameelNabbo/Jinja2-Code-execution",
"refsource": "MISC",
"url": "https://github.com/JameelNabbo/Jinja2-Code-execution"
},
{
"name": "46386",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/46386/"
},
{
"name": "openSUSE-SU-2019:1395",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00030.html"
},
{
"name": "openSUSE-SU-2019:1614",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00064.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1677653",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677653"
},
{
"name": "https://bugzilla.suse.com/show_bug.cgi?id=1125815",
"refsource": "CONFIRM",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1125815"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-8341",
"datePublished": "2019-02-15T07:00:00.000Z",
"dateReserved": "2019-02-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T21:17:30.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-0012 (GCVE-0-2014-0012)
Vulnerability from cvelistv5 – Published: 2014-05-19 14:00 – Updated: 2024-08-06 08:58
VLAI
Summary
FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/mitsuhiko/jinja2/pull/292 | x_refsource_MISC |
| http://secunia.com/advisories/56328 | third-party-advisoryx_refsource_SECUNIA |
| https://bugzilla.redhat.com/show_bug.cgi?id=1051421 | x_refsource_MISC |
| http://secunia.com/advisories/60738 | third-party-advisoryx_refsource_SECUNIA |
| https://github.com/mitsuhiko/jinja2/commit/acb672… | x_refsource_MISC |
| https://github.com/mitsuhiko/jinja2/pull/296 | x_refsource_MISC |
| http://www.gentoo.org/security/en/glsa/glsa-20140… | vendor-advisoryx_refsource_GENTOO |
| http://seclists.org/oss-sec/2014/q1/73 | mailing-listx_refsource_MLIST |
Date Public
2014-01-10 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:58:26.479Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/mitsuhiko/jinja2/pull/292"
},
{
"name": "56328",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56328"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051421"
},
{
"name": "60738",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60738"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/mitsuhiko/jinja2/pull/296"
},
{
"name": "GLSA-201408-13",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml"
},
{
"name": "[oss-security] 20140110 CVE assignment for jinja2",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://seclists.org/oss-sec/2014/q1/73"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-01-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user\u0027s uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-09-12T12:57:00.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mitsuhiko/jinja2/pull/292"
},
{
"name": "56328",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56328"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051421"
},
{
"name": "60738",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60738"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/mitsuhiko/jinja2/pull/296"
},
{
"name": "GLSA-201408-13",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml"
},
{
"name": "[oss-security] 20140110 CVE assignment for jinja2",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://seclists.org/oss-sec/2014/q1/73"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2014-0012",
"datePublished": "2014-05-19T14:00:00.000Z",
"dateReserved": "2013-12-03T00:00:00.000Z",
"dateUpdated": "2024-08-06T08:58:26.479Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-1402 (GCVE-0-2014-1402)
Vulnerability from cvelistv5 – Published: 2014-05-19 14:00 – Updated: 2024-08-06 09:42
VLAI
Summary
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
17 references
Date Public
2014-01-09 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T09:42:35.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[El-errata] 20140611 Oracle Linux Security Advisory ELSA-2014-0747",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://oss.oracle.com/pipermail/el-errata/2014-June/004192.html"
},
{
"name": "[oss-security] 20140110 Re: CVE Request: python-jinja2: arbitrary code execution vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2014/01/10/3"
},
{
"name": "59017",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/59017"
},
{
"name": "56287",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56287"
},
{
"name": "MDVSA-2014:096",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:096"
},
{
"name": "58783",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/58783"
},
{
"name": "58918",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/58918"
},
{
"name": "60738",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60738"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051421"
},
{
"name": "60770",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/60770"
},
{
"name": "RHSA-2014:0747",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0747.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://jinja.pocoo.org/docs/changelog/"
},
{
"name": "GLSA-201408-13",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml"
},
{
"name": "[oss-security] 20140110 CVE Request: python-jinja2: arbitrary code execution vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://openwall.com/lists/oss-security/2014/01/10/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://advisories.mageia.org/MGASA-2014-0028.html"
},
{
"name": "RHSA-2014:0748",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0748.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-01-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-21T15:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "[El-errata] 20140611 Oracle Linux Security Advisory ELSA-2014-0747",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://oss.oracle.com/pipermail/el-errata/2014-June/004192.html"
},
{
"name": "[oss-security] 20140110 Re: CVE Request: python-jinja2: arbitrary code execution vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2014/01/10/3"
},
{
"name": "59017",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/59017"
},
{
"name": "56287",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56287"
},
{
"name": "MDVSA-2014:096",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:096"
},
{
"name": "58783",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/58783"
},
{
"name": "58918",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/58918"
},
{
"name": "60738",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60738"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051421"
},
{
"name": "60770",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/60770"
},
{
"name": "RHSA-2014:0747",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0747.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://jinja.pocoo.org/docs/changelog/"
},
{
"name": "GLSA-201408-13",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml"
},
{
"name": "[oss-security] 20140110 CVE Request: python-jinja2: arbitrary code execution vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://openwall.com/lists/oss-security/2014/01/10/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://advisories.mageia.org/MGASA-2014-0028.html"
},
{
"name": "RHSA-2014:0748",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0748.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-1402",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[El-errata] 20140611 Oracle Linux Security Advisory ELSA-2014-0747",
"refsource": "MLIST",
"url": "https://oss.oracle.com/pipermail/el-errata/2014-June/004192.html"
},
{
"name": "[oss-security] 20140110 Re: CVE Request: python-jinja2: arbitrary code execution vulnerability",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2014/01/10/3"
},
{
"name": "59017",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/59017"
},
{
"name": "56287",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/56287"
},
{
"name": "MDVSA-2014:096",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:096"
},
{
"name": "58783",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/58783"
},
{
"name": "58918",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/58918"
},
{
"name": "60738",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60738"
},
{
"name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747",
"refsource": "CONFIRM",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1051421",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1051421"
},
{
"name": "60770",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/60770"
},
{
"name": "RHSA-2014:0747",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0747.html"
},
{
"name": "http://jinja.pocoo.org/docs/changelog/",
"refsource": "CONFIRM",
"url": "http://jinja.pocoo.org/docs/changelog/"
},
{
"name": "GLSA-201408-13",
"refsource": "GENTOO",
"url": "http://www.gentoo.org/security/en/glsa/glsa-201408-13.xml"
},
{
"name": "[oss-security] 20140110 CVE Request: python-jinja2: arbitrary code execution vulnerability",
"refsource": "MLIST",
"url": "http://openwall.com/lists/oss-security/2014/01/10/2"
},
{
"name": "http://advisories.mageia.org/MGASA-2014-0028.html",
"refsource": "CONFIRM",
"url": "http://advisories.mageia.org/MGASA-2014-0028.html"
},
{
"name": "RHSA-2014:0748",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0748.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-1402",
"datePublished": "2014-05-19T14:00:00.000Z",
"dateReserved": "2014-01-10T00:00:00.000Z",
"dateUpdated": "2024-08-06T09:42:35.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}