Red Hat Security Advisory: babel security and bug fix update

Fixed packages 2

Vulnerabilities 2

• High 7.8
  CVE-2021-42771

  Directory Traversal in Babel

  Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

  babel python-babel babel py3-babel Debian Azure Linux Alpine PyPI
  Oct 20, 2021
• Unscored —
  CVE-2021-20095 Rejected

  DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

  python-babel Ubuntu
  Apr 29, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1955615
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4201.json
• report
  https://access.redhat.com/security/cve/CVE-2021-20095
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20095
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20095
• article
  https://www.tenable.com/security/research/tra-2021-14
• report
  https://access.redhat.com/security/cve/CVE-2021-42771
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-42771
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-42771