Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-42771: Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | babel | 0:0.9.6-8.amzn2.0.2 |
| Amazon Linux · 2 | python-babel | 0:0.9.6-8.amzn2.0.2 |
Vulnerabilities 1
-
High 7.8
Directory Traversal in Babel
Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-42771.html