Red Hat Security AdvisoryRHSA-2021:3252
python27 security update
Released 2021-08-24 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-babel-0.9.6-10.el7, python27-python-2.7.18-3.el7, python27-python-babel-0.9.6-10.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) python27-babel-0.9.6-10.el7, python27-python-2.7.18-3.el7, python27-python-babel-0.9.6-10.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-babel-0.9.6-10.el7, python27-python-2.7.18-3.el7, python27-python-babel-0.9.6-10.el7 +8
Fixes 7 records
Priority HIGH 82
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demons…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.24002 · Published 2021-01-19 · Partial fix CWE-120
Priority MEDIUM 60
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08334 · Published 2020-10-22 · Partial fix
Priority MEDIUM 54
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.pars…
CVSS 3.1MEDIUM 5.9· Network · No auth · User interaction · EPSS 0.40736 · Published 2021-02-15 · Partial fix · 3.6.13, 3.7.10 +2 CWE-444
Priority LOW 39
In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03906 · Published 2021-03-17 · Partial fix · 2.7.4 CWE-1333
Priority LOW 38
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "except…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02759 · Published 2021-03-23 · Partial fix · 2.7.4 CWE-835
Priority LOW 35
Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0077 · Published 2021-10-20 · Partial fix · 2.9.1 CWE-22
Priority LOW 30
This affects the package jinja2 from 0.0.0 and before 2.11.3.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03589 · Published 2021-02-01 · Partial fix · 2.11.3 CWE-400
THREATIST.IORead the docs