CVE-2021-42771

Advisory

Babel 2.9.1 includes a fix for CVE-2021-42771: Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
https://github.com/python-babel/babel/pull/782

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution. See CVE-2021-42771.


MISC:https://github.com/python-babel/babel/pull/782: https://github.com/python-babel/babel/pull/782
MISC:https://lists.debian.org/debian-lts/2021/10/msg00040.html: https://lists.debian.org/debian-lts/2021/10/msg00040.html
MISC:https://www.tenable.com/security/research/tra-2021-14: https://www.tenable.com/security/research/tra-2021-14
MLIST:[debian-lts-announce] 20211021 [SECURITY] [DLA 2790-1] python-babel security update: https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html

Resources

• https://github.com/python-babel/babel/pull/782
• https://lists.debian.org/debian-lts/2021/10/msg00040.html
• https://www.tenable.com/security/research/tra-2021-14
• https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42771
• https://www.debian.org/security/2021/dsa-5018