Description
FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jinja2 | 2.7.2-2 | — |
| Debian 13 | jinja2 | 2.7.2-2 | — |
| Debian 12 | jinja2 | 2.7.2-2 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 12 | python-Jinja2 | 2.8-2.1 | openSUSE-SU-2019:0244-1 |
| SUSE Enterprise Storage 1.0 | python-Jinja2 | 2.7.3-4.1 | SUSE-SU-2015:1336-1 |
| SUSE Cloud Compute Node for SUSE Linux Enterprise 12 | python-Jinja2 | 2.7.3-4.1 | SUSE-SU-2015:1336-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Jinja2 | 2.8-1.4 | openSUSE-SU-2026:11992-1, openSUSE-SU-2024:13930-1, openSUSE-SU-2024:11208-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | jinja2 | < 2.7.2 | 2.7.2 | GHSA-fqh9-2qgg-h84h |
| PyPI | jinja2 | < 2.7.3 | 2.7.3 | PYSEC-2014-82 |
Advisories 6
- openSUSE-SU-2026:11992-1 python313-Jinja2-3.1.6-2.4 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- openSUSE-SU-2024:10129-1 python-Jinja2-2.8-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:0244-1 Security update for python-Jinja2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11208-1 python36-Jinja2-3.0.1-3.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13930-1 python310-Jinja2-3.1.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:1336-1 Security update for python-Jinja2 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/mitsuhiko/jinja2/pull/292
- 56328 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1051421
- 60738 third-party-advisory
- https://github.com/mitsuhiko/jinja2/commit/acb672b6a179567632e032f547582f30fa2f4aa7
- https://github.com/mitsuhiko/jinja2/pull/296
- GLSA-201408-13 vendor-advisory
- [oss-security] 20140110 CVE assignment for jinja2 mailing-list