Bug 1955615 (CVE-2021-20095, CVE-2021-42771)
Summary: | CVE-2021-20095 CVE-2021-42771 python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | apevec, bdettelb, fschwarz, hhorak, hvyas, jjoyce, jorton, jschluet, lhh, lpeer, mburns, nphilipp, python-maint, python-sig, sclewis, slinaber, tomckay |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | python-babel 2.9.1 | Doc Type: | If docs needed, set a value |
Doc Text: |
A flaw was found in python-babel. A path traversal vulnerability was found in how locale data files are checked and loaded within python-babel, allowing a local attacker to trick an application that uses python-babel to load a file outside of the intended locale directory. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2021-08-24 15:35:14 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1954814, 1955725, 1956899, 1956900, 1956901, 1956902, 1956903, 1956904, 1957075, 1964344, 1969504, 1969520 | ||
Bug Blocks: | 1955616 |
Description
Guilherme de Almeida Suckevicz
2021-04-30 14:18:16 UTC
Created babel tracking bugs for this issue: Affects: fedora-all [bug 1955725] External References: https://www.tenable.com/security/research/tra-2021-14 An application that uses `babel.Locale` to create a new Locale object with an untrusted language argument might be vulnerable to this flaw. The babel library uses the language argument to retrieve a file on disk, however it does not perform any check to ensure that the language is a well formed name and that it does not contain special path characters (e.g. `..`). The locale files are essentially dumps of pickle, thus an attacker who can create a file on the system and trick an application to use that file as a babel Locale can easily execute arbitrary code on the vulnerable system. This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2021:3252 https://access.redhat.com/errata/RHSA-2021:3252 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS Via RHSA-2021:3254 https://access.redhat.com/errata/RHSA-2021:3254 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-20095 *** Bug 2016686 has been marked as a duplicate of this bug. *** Note: this CVE ID was rejected by MITRE, and CVE-2021-42771 used instead to track this issue. Since Red Hat has already shipped errata referencing CVE-2021-20095, we continue to use this ID and instead mark CVE-2021-42771 as duplicate for our purposes. Both identifiers reference the same issue and carry the same analysis results, so the net result in terms of affected & fixed products is the same. Adding the new CVE-2021-42771 here as well, while keeping the original CVE-2021-20095 listed here as well, as it was already used in released errata. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4151 https://access.redhat.com/errata/RHSA-2021:4151 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4162 https://access.redhat.com/errata/RHSA-2021:4162 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:4201 https://access.redhat.com/errata/RHSA-2021:4201 |