[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201401101221.s0ACLW13011021@linus.mitre.org>
Date: Fri, 10 Jan 2014 07:21:32 -0500 (EST)
From: cve-assign@...re.org
To: ratulg@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: python-jinja2: arbitrary code execution vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Jinja2, a template engine written in pure python, was found to use /tmp
> as a default directory for jinja2.bccache.FileSystemBytecodeCache, which
> is insecure because the /tmp directory is world-writable and the
> filenames used like 'FileSystemBytecodeCache' are often predictable. A
> malicious user could exploit this bug to execute arbitrary code as
> another user.
Use CVE-2014-1402.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJSz+UnAAoJEKllVAevmvms9n4IAJCBezPErKYaadymt5zqE7WN
LjJ7UBfg6424Rgyg2rIuk/8oYxkWglYQnhlnByoLSm9u4Jk9Z4m0Bvgc2tNtyyrk
dg1eI8XYQcHU/TwsJEwZxq5bL581FjH3YlKN3a8GMg0jFGiIZfXoZ4Ucn7PllrNi
WaA8oXIHp6zqkZTLvdC3wd6WQiCyhtIccOYGR8j91N6IF94iy5YssvYctKX6OhfY
/1NT9TCxv6y4qQObYqxPCszd39HkxoM7MlZMqNOgjQeH+dlh1Wxyo2MQhVzOGNic
G7m+LMIRLw9yZKwwy2F1W7wOgh3q5aLsQ7FwwbqLOH83ZLODOuia37SzgoO+eIQ=
=vTFW
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
