Red Hat Bugzilla – Bug 1052102
CVE-2014-0012 python-jinja2: FileSystemBytecodeCache insecure cache temporary file use, incorrect CVE-2014-1402 fix
Last modified: 2016-04-26 23:19:51 EDT
An insecure temporary file creation vulnerability was introduced in Jinja2 in the fix for CVE-2014-1402 through the commit: https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7 References: http://seclists.org/oss-sec/2014/q1/73
Acknowledgement: This issue was discovered by Arun Babu Neelicattu of the Red Hat Security Response Team.
Statement: Not vulnerable. This issue did not affect the versions of python-jinja2 as shipped with Red Hat Enterprise Linux 6 as it did not include the patch that introduced this flaw.
This issue has pretty much identical impact to the original issue - file overwrites typical for temporary file handling issues, or application using spoofed cache file. As Jinja2 cache files contain python bytecode that is executed by Jinja2, there's a risk of direct code execution impact as a consequence of this flaw.
Bug 1051421 comment 20 has few notes on how upstream fix used in Jinja2 2.7.2 changes impact of the issue.
This patch used in Debian packages: http://patch-tracker.debian.org/patch/series/view/jinja2/2.7.2-2/fix_CVE-2014-0012.patch or this upstream pull request: https://github.com/mitsuhiko/jinja2/pull/292 both use tempfile.mkdtemp() to create directory used to store cache files. That does not seem like a viable approach, as previously discussed in bug 1051421 comment 12.