Medium ELSA-2021-4201 2 CVEs

Moderate: babel security and bug fix update (Oracle Linux 8)

Published Nov 16, 2021 · Updated Nov 16, 2021

Ecosystem: Oracle Linux

Summary

[2.5.1-7]
- Include the /usr/bin/pybabel binary that runs on Python 3.6 in the
python3-babel package
Resolves: rhbz#1967173

[2.5.1-6]
- Fix CVE-2021-20095
Resolves: rhbz#1955615

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 8	python3-babel	0:2.5.1-7.el8

Vulnerabilities 2

High 7.8

CVE-2021-42771

Directory Traversal in Babel

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

babel python-babel babel py3-babel Debian Azure Linux Alpine PyPI

Oct 20, 2021
Unscored —

CVE-2021-20095 Rejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

python-babel Ubuntu

Apr 29, 2021