CVE-2013-2027: Jython Improper Access Restrictions vulnerability in org.python:jython-standalone
Summary
CVE-2013-2027: Jython Improper Access Restrictions vulnerability. Affects org.python:jython-standalone versions < 2.7.2b3. Fixed in 2.7.2b3. How to fix ↓
Also tracked for
- jython · Debian:11
The same CVE-2013-2027 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jython is an implementation of the Python programming language written in Java. It allows Python code to run on the Java Virtual Machine (JVM). The org.python:jython-standalone package is a standalone distribution of Jython that includes all the necessary dependencies. This vulnerability affects versions prior to 2.7.2b3 of Jython. Jython uses the current umask to set the privileges of the class cache files, which can be exploited by local users to bypass intended access restrictions.
Vulnerability Detail
The vulnerability (CVE-2013-2027) in Jython allows local users to bypass access restrictions by exploiting the way class cache files are created. By manipulating the current umask, an attacker can gain unauthorized access to restricted resources. This can lead to unauthorized execution of code or unauthorized modification of sensitive data. The impact of this vulnerability depends on the specific access restrictions in place and the privileges associated with the compromised user.
How To Fix
Minimum fixed version
2.7.2b3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a workaround is to manually set the privileges of the class cache files to restrict access. This can be done by modifying the umask value before running Jython. However, this workaround may not provide complete protection and it is still recommended to upgrade to the fixed version as soon as possible.
Conclusion
The Jython Improper Access Restrictions vulnerability (CVE-2013-2027) allows local users to bypass access restrictions and potentially execute unauthorized code or modify sensitive data. It is recommended to upgrade to version 2.7.2b3 or later of the org.python:jython-standalone package to fix this vulnerability. If immediate upgrade is not possible, a workaround is available, but it may not provide complete protection. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.python:jython-standalone →
FAQ
Jython is an implementation of the Python programming language written in Java. It allows Python code to run on the Java Virtual Machine (JVM).
The org.python:jython-standalone package is a standalone distribution of Jython that includes all the necessary dependencies.
The impact of this vulnerability depends on the specific access restrictions in place and the privileges associated with the compromised user. It can lead to unauthorized execution of code or unauthorized modification of sensitive data.
To fix this vulnerability, upgrade to version 2.7.2b3 or later of the org.python:jython-standalone package.
A workaround is to manually set the privileges of the class cache files to restrict access, but it is still recommended to upgrade to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for org.python:jython-standalone.
