Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2014-0012

python-jinja2: FileSystemBytecodeCache insecure cache temporary file use, incorrect CVE-2014-1402 fix

FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pocoo
Products
Jinja2
CVE-2014-1402

python-jinja2: FileSystemBytecodeCache insecure cache temporary file use

The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pocoo Redhat
Products
Jinja2 Enterprise Linux Rhel Software Collections
CVE-2019-8341

python-jinja2: command injection in function from_string

An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing

CVSS 3.1 · 9.8 Critical EPSS 43.9% KEV · Not listed
Vendors
Opensuse Pocoo
Products
Leap Jinja2