Executive Summary

Summary
Title Jinja2: Multiple vulnerabilities
Informations
Name GLSA-201408-13 First vendor Publication 2014-08-29
Vendor Gentoo Last vendor Modification 2014-08-29
Severity (Vendor) Normal Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 4.4 Attack Range Local
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 3.4 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Multiple vulnerabilities have been found in Jinja2, allowing local attackers to escalate their privileges.

Background

Jinja2 is a template engine written in pure Python.

Description

Multiple vulnerabilities have been discovered in Jinja2. Please review the CVE identifiers referenced below for details.

Impact

A local attacker could gain escalated privileges via a specially crafted cache file or pre-created temporary directory.

Workaround

There is no known workaround at this time.

Resolution

All Jinja2 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-python/jinja-2.7.3"

References

[ 1 ] CVE-2014-0012 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0012
[ 2 ] CVE-2014-1402 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-1402

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201408-13.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201408-13.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-264 Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:24790
 
Oval ID: oval:org.mitre.oval:def:24790
Title: RHSA-2014:0747: python-jinja2 security update (Moderate)
Description: Jinja2 is a template engine written in pure Python. It provides a Django-inspired, non-XML syntax but supports inline expressions and an optional sandboxed environment. It was discovered that Jinja2 did not properly handle bytecode cache files stored in the system's temporary directory. A local attacker could use this flaw to alter the output of an application using Jinja2 and FileSystemBytecodeCache, and potentially execute arbitrary code with the privileges of that application. (CVE-2014-1402) All python-jinja2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all applications using python-jinja2 must be restarted.
Family: unix Class: patch
Reference(s): RHSA-2014:0747-00
CESA-2014:0747
CVE-2014-1402
 Version: 3
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
 Product(s): python-jinja2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24851
 
Oval ID: oval:org.mitre.oval:def:24851
Title: ELSA-2014:0747: python-jinja2 security update (Moderate)
Description: Jinja2 is a template engine written in pure Python. It provides a Django-inspired, non-XML syntax but supports inline expressions and an optional sandboxed environment. It was discovered that Jinja2 did not properly handle bytecode cache files stored in the system's temporary directory. A local attacker could use this flaw to alter the output of an application using Jinja2 and FileSystemBytecodeCache, and potentially execute arbitrary code with the privileges of that application. (CVE-2014-1402) All python-jinja2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all applications using python-jinja2 must be restarted.
Family: unix Class: patch
Reference(s): ELSA-2014:0747-00
CVE-2014-1402
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): python-jinja2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26103
 
Oval ID: oval:org.mitre.oval:def:26103
Title: USN-2301-1 -- jinja2 vulnerabilities
Description: A security issue was fixed in Jinja2.
Family: unix Class: patch
Reference(s): USN-2301-1
CVE-2014-0012
CVE-2014-1402
 Version: 3
Platform(s): Ubuntu 12.04
 Product(s): jinja2
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27287
 
Oval ID: oval:org.mitre.oval:def:27287
Title: DEPRECATED: ELSA-2014-0747 -- python-jinja2 security update (moderate)
Description: [2.2.1-2] - Fix CVE-2014-1402 Resolves: rhbz#1102889
Family: unix Class: patch
Reference(s): ELSA-2014-0747
CVE-2014-1402
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): python-jinja2
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 19

Nessus® Vulnerability Scanner

Date Description
2016-10-12 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-1159.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_jinja2_20141216.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-371.nasl - Type : ACT_GATHER_INFO
2014-08-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201408-13.nasl - Type : ACT_GATHER_INFO
2014-07-25 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2301-1.nasl - Type : ACT_GATHER_INFO
2014-06-23 Name : The remote Fedora host is missing a security update.
File : fedora_2014-7166.nasl - Type : ACT_GATHER_INFO
2014-06-23 Name : The remote Fedora host is missing a security update.
File : fedora_2014-7399.nasl - Type : ACT_GATHER_INFO
2014-06-12 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2014-0747.nasl - Type : ACT_GATHER_INFO
2014-06-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2014-0747.nasl - Type : ACT_GATHER_INFO
2014-06-12 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0747.nasl - Type : ACT_GATHER_INFO
2014-06-12 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140611_python_jinja2_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-05-19 Name : The remote Mandriva Linux host is missing a security update.
File : mandriva_MDVSA-2014-096.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-08-31 13:25:14
  • Multiple Updates
2014-08-29 21:22:14
  • First insertion