CVE-2014-1402

Name of the Vulnerable Software and Affected Versions Jinja2 versions prior to 2.7.2

Description The default configuration for bccache.FileSystemBytecodeCache in Jinja2 does not properly create temporary files. This allows local users to gain privileges via a crafted .cache file with a name starting with jinja2 in /tmp.

Recommendations For versions prior to 2.7.2, update to version 2.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp directory to minimize the risk of exploitation. Avoid using the bccache.FileSystemBytecodeCache with the default configuration until the issue is resolved.