CVE-2014-1402 – python-jinja2: FileSystemBytecodeCache insecure cache temporary file use

https://notcve.org/view.php?id=CVE-2014-1402

The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp. La configuración por defecto para bccache.FileSystemBytecodeCache en Jinja2 anterior a 2.7.2 no crea debidamente archivos temporales, lo que permite a usuarios locales ganar privilegios a través de un archivo .cache manipulado con un nombre que empieza con __jinja2_ en /tmp. • http://advisories.mageia.org/MGASA-2014-0028.html http://jinja.pocoo.org/docs/changelog http://openwall.com/lists/oss-security/2014/01/10/2 http://openwall.com/lists/oss-security/2014/01/10/3 http://rhn.redhat.com/errata/RHSA-2014-0747.html http://rhn.redhat.com/errata/RHSA-2014-0748.html http://secunia.com/advisories/56287 http://secunia.com/advisories/58783 http://secunia.com/advisories/58918 http://secunia.com/advisories/59017 http://secunia.com/advisorie • CWE-264: Permissions, Privileges, and Access Controls CWE-377: Insecure Temporary File •