CVE-2014-1402
Incorrect Privilege Assignment in Jinja2
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with _jinja2 in /tmp.
Exploit likelihood
What each source reports
NVD Score used
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with _jinja2 in /tmp.
- Record
CVE-2014-1402- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with _jinja2 in /tmp.
- Record
CVE-2014-1402- Updated
- 2026-11-02
EUVDEUVD-2014-0023 No score
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with _jinja2 in /tmp.
- Record
EUVD-2014-0023- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8r7q-cvjq-x353
Incorrect Privilege Assignment in Jinja2
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
- Record
GHSA-8r7q-cvjq-x353- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-266
- Updated
- 2026-11-02
OSVGHSA-8r7q-cvjq-x353
Incorrect Privilege Assignment in Jinja2
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
- Record
GHSA-8r7q-cvjq-x353- CVSS 4.0
- 8.6 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-266
- Updated
- 2026-11-02
OSV No score
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with _jinja2 in /tmp.
- Record
CVE-2014-1402- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2014-1402 No score
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with _jinja2 in /tmp.
- Record
DEBIAN-CVE-2014-1402- Updated
- 2026-11-02
OSVMGASA-2014-0028 No score
Updated python-jinja2 package fixes two security vulnerabilities
Updated python-jinja2 packages fix security vulnerability:
Jinja2, a template engine written in pure python, was found to use /tmp as a default directory for jinja2.bccache.FileSystemBytecodeCache, which is insecure because the /tmp directory is world-writable and the filenames used like 'FileSystemBytecodeCache' are often predictable. A malicious user could exploit this bug to execute arbitrary code as another user. (CVE-2014-1402)
- Record
MGASA-2014-0028- Updated
- 2026-11-02
OSVPYSEC-2014-8 No score
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with _jinja2 in /tmp.
- Record
PYSEC-2014-8- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-1402 No score
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with _jinja2 in /tmp.
- Record
UBUNTU-CVE-2014-1402- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jinja2PyPI |
before 2.7.2 | 2.7.2 |
jinja2Debian:12 |
before 2.7.2-1 | 2.7.2-1 |
jinja2Debian:13 |
before 2.7.2-1 | 2.7.2-1 |
jinja2Debian:14 |
before 2.7.2-1 | 2.7.2-1 |
jinja2PyPI |
before 2.7.2, plus listed versions 2.02.0rc12.12.1.12.2 Show 14 moreShow less2.2.12.32.3.12.42.4.12.52.5.12.5.22.5.32.5.42.5.52.62.72.7.1 |
2.7.2 |
python-jinja2Mageia:3 |
before 2.5.5-8.2.mga3 | 2.5.5-8.2.mga3 |
python-jinja2Red Hat:enterprise_linux:6::client |
before 0:2.2.1-2.el6_5 | 0:2.2.1-2.el6_5 |
python-jinja2-debuginfoRed Hat:enterprise_linux:6::client |
before 0:2.2.1-2.el6_5 | 0:2.2.1-2.el6_5 |
python-jinja2Red Hat:enterprise_linux:6::computenode |
before 0:2.2.1-2.el6_5 | 0:2.2.1-2.el6_5 |
python-jinja2-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:2.2.1-2.el6_5 | 0:2.2.1-2.el6_5 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-jinja2Red Hat:enterprise_linux:6::server |
before 0:2.2.1-2.el6_5 | 0:2.2.1-2.el6_5 |
python-jinja2-debuginfoRed Hat:enterprise_linux:6::server |
before 0:2.2.1-2.el6_5 | 0:2.2.1-2.el6_5 |
python-jinja2Red Hat:enterprise_linux:6::workstation |
before 0:2.2.1-2.el6_5 | 0:2.2.1-2.el6_5 |
python-jinja2-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:2.2.1-2.el6_5 | 0:2.2.1-2.el6_5 |
python27-python-jinja2Red Hat:rhel_software_collections:1::el6 |
before 0:2.6-10.el6 | 0:2.6-10.el6 |
python33-python-jinja2Red Hat:rhel_software_collections:1::el6 |
before 0:2.6-11.el6 | 0:2.6-11.el6 |
python27-python-jinja2Red Hat:rhel_software_collections:1::el7 |
before 0:2.6-11.el7 | 0:2.6-11.el7 |
python33-python-jinja2Red Hat:rhel_software_collections:1::el7 |
before 0:2.6-12.el7 | 0:2.6-12.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1402 is a medium vulnerability (CVSS 4.4) in Pocoo Jinja2, published January 24, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in jinja2 2.7.2.
References
oss.oracle.com/pipermail/el-errata/2014-June/004192.html
openwall.com/lists/oss-security/2014/01/10/3
secunia.com/advisories/59017
mandriva.com/security/advisories?name=MDVSA-2014:096
Show 26 moreShow less
bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747
bugzilla.redhat.com/show_bug.cgi?id=1051421
rhn.redhat.com/errata/RHSA-2014-0747.html
jinja.pocoo.org/docs/changelog
gentoo.org/security/en/glsa/glsa-201408-13.xml
advisories.mageia.org/MGASA-2014-0028.html
nvd.nist.gov/vuln/detail/CVE-2014-1402
github.com/advisories/GHSA-8r7q-cvjq-x353
web.archive.org/web/20150523060528/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2014:096?name=MDVSA-2014:096
security-tracker.debian.org/tracker/CVE-2014-1402
bugs.mageia.org/show_bug.cgi?id=12265
access.redhat.com/errata/RHSA-2014:0747
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0747.json
cve.org/CVERecord?id=CVE-2014-1402
ubuntu.com/security/CVE-2014-1402