CVE-2021-42771

Опубликовано: 20 окт. 2021

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Низкий

Описание

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

Ссылки

https://github.com/python-babel/babel/pull/782
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts/2021/10/msg00040.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2021/dsa-5018
Third Party Advisory
https://www.tenable.com/security/research/tra-2021-14
Exploit
Third Party Advisory
https://github.com/python-babel/babel/pull/782
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts/2021/10/msg00040.html
Mailing List
Third Party Advisory
https://www.debian.org/security/2021/dsa-5018
Third Party Advisory
https://www.tenable.com/security/research/tra-2021-14
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pocoo:babel:*:*:*:*:*:*:*:*

Версия до 2.9.1 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 33%

0.0013

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2021-42771

CVSS3: 7.8

ubuntu

около 4 лет назад

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

CVE-2021-42771

CVSS3: 7.8

redhat

больше 4 лет назад

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

CVE-2021-42771

CVSS3: 7.8

msrc

около 4 лет назад

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal leading to code execution.

CVE-2021-42771

CVSS3: 7.8

debian

около 4 лет назад

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary ...

openSUSE-SU-2021:3945-1

suse-cvrf

почти 4 года назад

Security update for python-Babel

EPSS

Процентиль: 33%

0.0013

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-22