Red Hat Security AdvisoryRHSA-2021:4151
python27:2.7 security update
Released 2021-11-09 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, PyYAML-3.12-16.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, babel-2.5.1-10.module+el8.5.0+11014+88fc0d0b.noarch::python27:2.7 +47
Fixes 7 records
Priority MEDIUM 60
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08334 · Published 2020-10-22 · Partial fix
Priority MEDIUM 54
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.pars…
CVSS 3.1MEDIUM 5.9· Network · No auth · User interaction · EPSS 0.40736 · Published 2021-02-15 · Partial fix · 3.6.13, 3.7.10 +2 CWE-444
Priority LOW 39
In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03906 · Published 2021-03-17 · Partial fix · 2.7.4 CWE-1333
Priority LOW 38
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "except…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02759 · Published 2021-03-23 · Partial fix · 2.7.4 CWE-835
Priority LOW 35
Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0077 · Published 2021-10-20 · Partial fix · 2.9.1 CWE-22
Priority LOW 34
An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.04035 · Published 2021-03-21 · Partial fix · 4.6.3 CWE-79
Priority LOW 30
This affects the package jinja2 from 0.0.0 and before 2.11.3.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.03589 · Published 2021-02-01 · Partial fix · 2.11.3 CWE-400
THREATIST.IORead the docs