Red Hat Security Advisory: python27 security update

Fixed packages 12

Vulnerabilities 8

• Critical 9.8
  CVE-2021-3177 EPSS 24%

  Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code exec…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Alpine
  Jan 19, 2021
• High 7.8
  CVE-2021-42771

  Directory Traversal in Babel

  Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

  babel babel py3-babel python-babel Debian Azure Linux Alpine PyPI
  Oct 20, 2021
• High 7.5
  CVE-2021-20270

  Infinite Loop in Pygments

  An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

  mediawiki pygments pygments pygments Debian Ubuntu Azure Linux Alpine PyPI
  Mar 23, 2021
• High 7.5
  CVE-2021-27291

  Pygments vulnerable to Regular Expression Denial of Service (ReDoS)

  In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an …

  mediawiki pygments pygments pygments Debian Ubuntu Azure Linux Alpine PyPI
  Mar 17, 2021
• Medium 5.9
  CVE-2021-23336 EPSS 41%

  Web Cache Poisoning

  The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called par…

  python-django python-django python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  Feb 15, 2021
• Medium 5.3
  CVE-2020-28493

  Regular Expression Denial of Service (ReDoS)

  This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. T…

  nodejs nodejs24 jinja2 jinja2 Debian Ubuntu Azure Linux Alpine PyPI
  Feb 1, 2021
• Unscored —
  CVE-2020-27619

  In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via …

  python3.4 python3.5 python3.6 python3.8 Debian Ubuntu
  Oct 22, 2020
• Unscored —
  CVE-2021-20095 Rejected

  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

  python-babel Ubuntu
  Apr 29, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/articles/5860431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1889886
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1918168
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1922136
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1928707
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1928904
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1940603
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1955615
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3252.json
• report
  https://access.redhat.com/security/cve/CVE-2020-27619
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-27619
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-27619
• report
  https://access.redhat.com/security/cve/CVE-2020-28493
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28493
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28493
• report
  https://access.redhat.com/security/cve/CVE-2021-3177
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3177
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3177
• report
  https://access.redhat.com/security/cve/CVE-2021-20095
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20095
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20095
• article
  https://www.tenable.com/security/research/tra-2021-14
• report
  https://access.redhat.com/security/cve/CVE-2021-20270
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20270
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20270
• report
  https://access.redhat.com/security/cve/CVE-2021-23336
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23336
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23336
• article
  https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
• report
  https://access.redhat.com/security/cve/CVE-2021-27291
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-27291
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-27291
• report
  https://access.redhat.com/security/cve/CVE-2021-42771
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-42771
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-42771