| Summary: | python-babel new security issue CVE-2021-20095 / CVE-2021-42771 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | geiger.david68210, herman.viaene, ouaurelien, sysadmin-bugs, tarazed25 |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA7TOO MGA7-64-OK MGA8-64-OK | ||
| Source RPM: | python-babel-2.9.0-1.mga8.src.rpm | CVE: | CVE-2021-20095 |
| Status comment: | |||
|
Description
David Walser
2021-05-29 01:15:40 CEST
David Walser
2021-05-29 01:15:57 CEST
Whiteboard:
(none) =>
MGA8TOO, MGA7TOO No registered maintainer, assigning to the Python team. Assignee:
bugsquad =>
python The issue is also fixed upstream in 2.9.1: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/J6N66MDKHESXGMHWX4YKNW7DWXMQVL3F/ Done for Cauldron, mga8 and mga7! CC:
(none) =>
geiger.david68210 RPMS: python2-babel-2.6.0-2.1.mga7 python3-babel-2.6.0-2.1.mga7 python3-babel-2.9.1-1.mga8 from SRPMS: python-babel-2.6.0-2.1.mga7.src.rpm python-babel-2.9.1-1.mga8.src.rpm Whiteboard:
MGA8TOO, MGA7TOO =>
MGA7TOO MGA7-64 Plasma on Lenovo B50 No installation issues. OK'ing on clean install as for other developer's stuff. CC:
(none) =>
herman.viaene (In reply to Herman Viaene from comment #5) > MGA7-64 Plasma on Lenovo B50 > No installation issues. > OK'ing on clean install as for other developer's stuff. MGA8 64 Plasma. On clean isntall, this is OK. Source RPM:
python-babel-2.9.0-2.mga9.src.rpm =>
python-babel-2.9.0-1.mga8.src.rpm Advisory: ======================== Updated python-babel packages fix a security vulnerability: Relative Path Traversal in Babel 2.9.0 allows an attacker to load arbitrary locale files on disk and execute arbitrary code (CVE-2021-20095). References: - https://bugs.mageia.org/show_bug.cgi?id=29011 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20095 - https://ubuntu.com/security/notices/USN-4962-1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/J6N66MDKHESXGMHWX4YKNW7DWXMQVL3F/ ======================== Updated packages in 7/core/updates_testing: ======================== python2-babel-2.6.0-2.1.mga7 python3-babel-2.6.0-2.1.mga7 from SRPMS: python-babel-2.6.0-2.1.mga7.src.rpm ======================== Updated packages in 8/core/updates_testing: ======================== python3-babel-2.9.1-1.mga8 from SRPM: python-babel-2.9.1-1.mga8.src.rpm ======================== Validating. Keywords:
(none) =>
advisory, validated_update An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0267.html Status:
NEW =>
RESOLVED This CVE was rejected in favor of CVE-2021-42771: https://www.debian.org/lts/security/2021/dla-2790 Summary:
python-babel new security issues CVE-2021-20095 =>
python-babel new security issue CVE-2021-20095 / CVE-2021-42771 Curiosity check :- $ rpm -q python3-babel python3-babel-2.9.1-1.mga8 Followed the PoC trail for CVE-2021-42771. Copied the python script at https://www.tenable.com/security/research/tra-2021-14 and ran it. $ python3 babel_id_exploit.py Created /tmp/evil.dat Traceback (most recent call last): File "babel_id_exploit.py", line 18, in <module> locale = babel.Locale(language) File "/usr/lib/python3.8/site-packages/babel/core.py", line 168, in __init__ raise UnknownLocaleError(identifier) babel.core.UnknownLocaleError: unknown locale '../../../../../../../../../../tmp/evil' Looks like a win for the update. CC:
(none) =>
tarazed25 |