CVE-2013-2027: Medium severity suse linux vulnerability
Description of problem:
There are serveral problems with the way Jython creates class cache files, potentially leading to arbitrary code execution or information disclosure.
(umask 000; jython -c 'import xmllib') ls -l '/usr/share/jython/Lib/xmllib$py.class' -rw-rw-rw-. 1 root root 52874 Apr 3 17:24 /usr/share/jython/Lib/xmllib$py.class
Jython does not explicitly set permissions of the class files; therefore with weak umask it creates world-writable files, or discloses sensitive data that would be in a non-world-readable package file.
Also, the package writes to /usr/share, which it shouldn't; /var/cache would be more appropriate, but would still lead to a possibility of a content disclosure.
The only really portable and secure way to cache class files would be a directory in user's home with 0700 permissions.
It is currently even not possible to easily disable the caching, since the configuration file is not marked with %config and resides in /usr/share instead of /etc.
Version-Release number of selected component (if applicable):
jython-2.2.1-4.8.el6.x8664
Other sources
Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.
— MITRE
Jython before 2.7.2b3 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2027?
CVE-2013-2027 is classified as a high severity vulnerability due to potential arbitrary code execution and information disclosure.
How do I fix CVE-2013-2027?
To fix CVE-2013-2027, upgrade Jython to version 2.7.2b3 or later to mitigate the risks associated with this vulnerability.
What software is affected by CVE-2013-2027?
CVE-2013-2027 affects Jython versions prior to 2.7.2b3, specifically on platforms such as openSUSE 13.1 and 13.2.
What are the potential risks of CVE-2013-2027?
The potential risks of CVE-2013-2027 include arbitrary code execution and exposure of sensitive information.
Is CVE-2013-2027 related to Jython's class cache files?
Yes, CVE-2013-2027 arises from issues in how Jython creates class cache files, leading to serious security implications.