Information disclosure in python
Priority LOW 29CWE-200Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 6 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-200.
Summary
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01863 79th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 6 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | python | python 3.8.9, python 3.9.3, python 3.10.0a7 | — | No fix listed | CNA |
- python Vendor— Affected python 3.8.9, python 3.9.3, python 3.10.0a7 Fixed in — No fix listed CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | before 2.7.18; 3.6.0 to before 3.6.13; 3.7.0 to before 3.7.10; 3.8.0 to before 3.8.8; 3.9.0 to before 3.9.3 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha1:*:*:*:*:*:* | 3.10.0 alpha1 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha2:*:*:*:*:*:* | 3.10.0 alpha2 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha3:*:*:*:*:*:* | 3.10.0 alpha3 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha4:*:*:*:*:*:* | 3.10.0 alpha4 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha5:*:*:*:*:*:* | 3.10.0 alpha5 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.10.0:alpha6:*:*:*:*:*:* | 3.10.0 alpha6 | Vulnerable | python-pillow |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions before 2.7.18; 3.6.0 to before 3.6.13; 3.7.0 to before 3.7.10; 3.8.0 to before 3.8.8; 3.9.0 to before 3.9.3 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha1:*:*:*:*:*:* Versions 3.10.0 alpha1 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha2:*:*:*:*:*:* Versions 3.10.0 alpha2 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha3:*:*:*:*:*:* Versions 3.10.0 alpha3 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha4:*:*:*:*:*:* Versions 3.10.0 alpha4 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha5:*:*:*:*:*:* Versions 3.10.0 alpha5 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.10.0:alpha6:*:*:*:*:*:* Versions 3.10.0 alpha6 Vulnerable ·python-pillow
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:* | 1.10.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Oracle |
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
Remediation
Red Hat 4 advisories
- RHSA-2021:4160 Released 2021-11-09 · Red Hat rating Moderatepython39:3.9 and python39-devel:3.9 security update
- Red Hat CodeReady Linux Builder (v. 8) Cython-0.29.21-5.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pybind11-2.6.1-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9 +33
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-4.module+el8.4.0+9822+20bf1249.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
- RHSA-2021:4399 Released 2021-11-09 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-41.el8, platform-python-debug-3.6.8-41.el8, platform-python-devel-3.6.8-41.el8 +3
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-41.el8, python3-3.6.8-41.el8, python3-libs-3.6.8-41.el8 +1
- RHSA-2021:4162 Released 2021-11-09 · Red Hat rating Moderatepython38:3.8 and python38-devel:3.8 security update
- Red Hat CodeReady Linux Builder (v. 8) pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8 +15
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src::python38:3.8, PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src::python38:3.8, babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src::python38:3.8 +47
Show 1 more Red Hat advisories
- RHSA-2021:3254 Released 2021-08-24 · Red Hat rating Moderaterh-python38 security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix planned: Will not fix |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2021:4160, RHSA-2021:4162 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:4160, RHSA-2021:4162, RHSA-2021:4399 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2021:4399 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:3254 |
Not affected: 4 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3426
- 2026-10-03 Alias added: GHSA-6qp6-q95v-x2qw
References
Patch 3
Advisory 10
- [debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update
- FEDORA-2021-a311bf10d4
- FEDORA-2021-2ab6f060d9
- FEDORA-2021-1769a23935
- FEDORA-2021-b6b6093b3a
- FEDORA-2021-067c9deff1
- FEDORA-2021-0a8f3ffbc0
- FEDORA-2021-a26257ccf5
- GLSA-202104-04
- https://security.netapp.com/advisory/ntap-20210629-0003/
Sources
- CVE-2021-3426 · CVE Program
- CVE-2021-3426 · NVD
- FIRST EPSS
- GHSA-6qp6-q95v-x2qw · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3426 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences