Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 492
Alerts This Week
Warning Icon 1 492

Scientific Linux Security Advisory: SLSA-2014-0747-1 Python Jinja2 Risk

Calendar Jun 11, 2014 • User Avatar LinuxSecurity Advisories
1 min read
Scientific Large Esm H446
Topics%20covered

Topics Covered

security advisory moderate arbitrary code execution local attack python-jinja2 scientific linux
Moderate: python-jinja2 security update 
Date: Wed, 11 Jun 2014 20:07:11 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Moderate: python-jinja2 on SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis: Moderate: python-jinja2 security update
Advisory ID: SLSA-2014:0747-1
Issue Date: 2014-06-11
CVE Numbers: CVE-2014-1402
--

It was discovered that Jinja2 did not properly handle bytecode cache files
stored in the system's temporary directory. A local attacker could use
this flaw to alter the output of an application using Jinja2 and
FileSystemBytecodeCache, and potentially execute arbitrary code with the
privileges of that application. (CVE-2014-1402)

For the update to take effect, all applications using python-jinja2 must
be restarted.
--

SL6
 x86_64
 python-jinja2-2.2.1-2.el6_5.x86_64.rpm
 python-jinja2-debuginfo-2.2.1-2.el6_5.x86_64.rpm
 i386
 python-jinja2-2.2.1-2.el6_5.i686.rpm
 python-jinja2-debuginfo-2.2.1-2.el6_5.i686.rpm

- Scientific Linux Development Team