Description
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jinja2 | 2.7.2-1 | — |
| Debian 13 | jinja2 | 2.7.2-1 | — |
| Debian 12 | jinja2 | 2.7.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | python-jinja2 | 2.2.1-2.el6_5 | RHSA-2014:0747 |
| RHEL 1 | python27-python-jinja2 | 2.6-10.el6 | RHSA-2014:0748 |
| RHEL 1 | python33-python-jinja2 | 2.6-11.el6 | RHSA-2014:0748 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | jinja2 | < 2.7.2 | 2.7.2 | GHSA-8r7q-cvjq-x353 |
Advisories 2
- RHSA-2014:0747 Red Hat Security Advisory: python-jinja2 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:0748 Red Hat Security Advisory: python33-python-jinja2 and python27-python-jinja2 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- [El-errata] 20140611 Oracle Linux Security Advisory ELSA-2014-0747 mailing-list
- [oss-security] 20140110 Re: CVE Request: python-jinja2: arbitrary code execution vulnerability mailing-list
- 59017 third-party-advisory
- 56287 third-party-advisory
- MDVSA-2014:096 vendor-advisory
- 58783 third-party-advisory
- 58918 third-party-advisory
- 60738 third-party-advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747
- https://bugzilla.redhat.com/show_bug.cgi?id=1051421
- 60770 third-party-advisory
- RHSA-2014:0747 vendor-advisory
- http://jinja.pocoo.org/docs/changelog/
- GLSA-201408-13 vendor-advisory
- [oss-security] 20140110 CVE Request: python-jinja2: arbitrary code execution vulnerability mailing-list
- http://advisories.mageia.org/MGASA-2014-0028.html
- RHSA-2014:0748 vendor-advisory