Moderate: python27:2.7 security update (Oracle Linux 8)

Fixed packages 62

Vulnerabilities 8

• High 7.8
  CVE-2021-42771

  Directory Traversal in Babel

  Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

  babel babel py3-babel python-babel Debian Azure Linux Alpine PyPI
  Oct 20, 2021
• High 7.5
  CVE-2021-20270

  Infinite Loop in Pygments

  An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

  mediawiki pygments pygments pygments Debian Ubuntu Azure Linux Alpine PyPI
  Mar 23, 2021
• High 7.5
  CVE-2021-27291

  Pygments vulnerable to Regular Expression Denial of Service (ReDoS)

  In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an …

  mediawiki pygments pygments pygments Debian Ubuntu Azure Linux Alpine PyPI
  Mar 17, 2021
• Medium 6.1
  CVE-2021-28957

  lxml vulnerable to Cross-Site Scripting

  An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attac…

  lxml lxml python-lxml lxml Debian Ubuntu Azure Linux Alpine PyPI
  Mar 21, 2021
• Medium 5.9
  CVE-2021-23336 EPSS 41%

  Web Cache Poisoning

  The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called par…

  python-django python-django python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  Feb 15, 2021
• Medium 5.3
  CVE-2020-28493

  Regular Expression Denial of Service (ReDoS)

  This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. T…

  nodejs nodejs24 jinja2 jinja2 Debian Ubuntu Azure Linux Alpine PyPI
  Feb 1, 2021
• Unscored —
  CVE-2020-27619

  In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via …

  python3.4 python3.5 python3.6 python3.8 Debian Ubuntu
  Oct 22, 2020
• Unscored —
  CVE-2021-20095 Rejected

  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

  python-babel Ubuntu
  Apr 29, 2021