Relative Path Traversal in Babel 2.9.0 allows an attacker to load arbitrary locale files on disk and execute arbitrary code.

A flaw was found in python-babel. A path traversal vulnerability was found in how locale data files are checked and loaded within python-babel, allowing a local attacker to trick an application that uses python-babel to load a file outside of the intended locale directory. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability.

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none

Moderate: babel security and bug fix update

ELSA-2021-4201: babel security and bug fix update (MODERATE)

Moderate: python27:2.7 security update

ELSA-2021-4151: python27:2.7 security update (MODERATE)

ELSA-2021-4162: python38:3.8 and python38-devel:3.8 security update (MODERATE)

Moderate: python38:3.8 and python38-devel:3.8 security update