Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2014-0012

python-jinja2: FileSystemBytecodeCache insecure cache temporary file use, incorrect CVE-2014-1402 fix

FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pocoo
Products
Jinja2
CVE-2014-1402

python-jinja2: FileSystemBytecodeCache insecure cache temporary file use

The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pocoo Redhat
Products
Jinja2 Enterprise Linux Rhel Software Collections
CVE-2021-42771

python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Pocoo Redhat
Products
Debian Linux Babel Enterprise Linux and 1 more
CVE-2019-8341

python-jinja2: command injection in function from_string

An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing

CVSS 3.1 · 9.8 Critical EPSS 43.9% KEV · Not listed
Vendors
Opensuse Pocoo
Products
Leap Jinja2