Moderate: python38:3.8 and python38-devel:3.8 security update (Oracle Linux 8)

Fixed packages 51

Vulnerabilities 10

• High 7.8
  CVE-2021-42771

  Directory Traversal in Babel

  Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

  babel babel py3-babel python-babel Debian Azure Linux Alpine PyPI
  Oct 20, 2021
• High 7.5
  CVE-2019-18874

  Double Free in psutil

  psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

  py3-psutil python-psutil python-psutil psutil Debian Ubuntu Azure Linux Alpine PyPI
  Nov 12, 2019
• High 7.5
  CVE-2021-33503

  Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

  An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a para…

  python-pip urllib3 python-urllib3 python-urllib3 Debian Ubuntu Azure Linux PyPI
  Jun 29, 2021
• Medium 6.1
  CVE-2021-28957

  lxml vulnerable to Cross-Site Scripting

  An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attac…

  lxml lxml python-lxml lxml Debian Ubuntu Azure Linux Alpine PyPI
  Mar 21, 2021
• Medium 5.9
  CVE-2021-23336 EPSS 41%

  Web Cache Poisoning

  The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called par…

  python-django python-django python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  Feb 15, 2021
• Medium 5.7
  CVE-2021-3426

  There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or …

  python3.4 python3.5 python3.6 python3.8 Debian Ubuntu Azure Linux Alpine
  May 20, 2021
• Medium 5.7
  CVE-2021-3572 Public exploit

  Improper Input Validation in pip

  A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This i…

  python-pip pip python-pip python-IPy Debian Ubuntu Azure Linux PyPI
  Nov 10, 2021
• Medium 5.3
  CVE-2020-28493

  Regular Expression Denial of Service (ReDoS)

  This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. T…

  nodejs nodejs24 jinja2 jinja2 Debian Ubuntu Azure Linux Alpine PyPI
  Feb 1, 2021
• Unscored —
  CVE-2021-20095 Rejected

  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

  python-babel Ubuntu
  Apr 29, 2021
• Unscored —
  CVE-2021-29921

  In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string.…

  python3.8 python3.9 pypy3 python3 Debian Ubuntu Alpine
  May 6, 2021