CVE-2013-2027

Jython Improper Access Restrictions vulnerability

4.6 MediumFix available

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

Exploit likelihood

0.43%Down 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 4.6

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

Record: CVE-2013-2027
CVSS 2.0: 4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

Record: CVE-2013-2027
Updated: 2026-11-02

EUVDEUVD-2022-3281 No score

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

Record: EUVD-2022-3281
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9347-9w64-q5wp No score

Jython Improper Access Restrictions vulnerability

Jython before 2.7.2b3 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

Record: GHSA-9347-9w64-q5wp
Weakness: CWE-281
Updated: 2026-11-02

OSV No score

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

Record: CVE-2013-2027
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-2027 No score

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

Record: DEBIAN-CVE-2013-2027
Updated: 2026-11-02

Show 4 moreShow less

OSVGHSA-9347-9w64-q5wp No score

Jython Improper Access Restrictions vulnerability

Jython before 2.7.2b3 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

Record: GHSA-9347-9w64-q5wp
Weakness: CWE-281
Updated: 2026-11-02

OSVMGASA-2015-0096 No score

Updated jython packages fix CVE-2013-2027

Updated jython packages fix security vulnerability:

There are serveral problems with the way Jython creates class cache files, potentially leading to arbitrary code execution or information disclosure (CVE-2013-2027).

Record: MGASA-2015-0096
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10443-1 No score

jython-2.2.1-16.10 on GA media

These are all security issues fixed in the jython-2.2.1-16.10 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10443-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2013-2027 No score

Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.

Record: UBUNTU-CVE-2013-2027
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.python:jython-standalone` Maven	before 2.7.2b3	2.7.2b3
`jython` Debian:12	before 2.7.1+repack-1	2.7.1+repack-1
`jython` Debian:13	before 2.7.1+repack-1	2.7.1+repack-1
`jython` Debian:14	before 2.7.1+repack-1	2.7.1+repack-1
`org.python:jython-standalone` Maven	before 2.7.2b3, plus listed versions 2.5.12.5.22.5.32.5.3-rc12.5.4-rc1 Show 15 moreShow less 2.7-b12.7-b22.7-b32.7-b42.7-rc12.7-rc22.7-rc32.7.02.7.12.7.1-rc22.7.1-rc32.7.1b12.7.1b22.7.1b32.7.2b2	2.7.2b3
`jython` Mageia:4	before 2.2.1-13.2.mga4	2.2.1-13.2.mga4
`jython` Ubuntu:14.04:LTS	before 2.5.3-1ubuntu0.1, plus listed versions 2.5.2-22.5.3-1	2.5.3-1ubuntu0.1
`jython` Ubuntu:16.04:LTS	before 2.5.3-9ubuntu0.1, plus listed versions 2.5.3-62.5.3-72.5.3-82.5.3-9	2.5.3-9ubuntu0.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2027 is a medium vulnerability (CVSS 4.6) in Jython Project Jython, published February 13, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in org.python:jython-standalone 2.7.2b3.

References

Show 8 moreShow less