PYSEC-2021-421

En bref

Publiée: 2021-10-20 21:15 UTC
Mise à jour: 2023-11-08 04:07 UTC
CVE: CVE-2021-42771
Alias: GHSA-h4m5-qpfp-3mpv

Description

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

Paquets affectés

Paquet	Versions
PyPI · babel	introduced 0, fixed 2.9.1

Références

https://www.tenable.com/security/research/tra-2021-14 WEB
https://lists.debian.org/debian-lts/2021/10/msg00040.html WEB
https://github.com/python-babel/babel/pull/782 WEB
https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html WEB
https://github.com/advisories/GHSA-h4m5-qpfp-3mpv ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database