Security Bulletin: CVE-2021-42771

Summary

A flaw was found in python-babel. A path traversal vulnerability was found in how locale data files are checked and loaded within python-babel, allowing a local attacker to trick an application that uses python-babel to load a file outside of the intended locale directory. The highest threat from this vulnerability is to data confidentiality and integrity as well as service availability.

Vulnerability Details

CVEID:CVE-2021-42771
**DESCRIPTION:**Python-Babel Babel could allow a local authenticated attacker to traverse directories on the system, caused by a flaw in the Babel.Locale function. An attacker could load a specially-crafted .dat file containing “dot dot” sequences (/…/) to execute arbitrary code on the system.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/211766 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

2.0.0.0

2.0.1

2.0.1.1

2.0.2

2.0.2.1

Remediation/Fixes

IBM PowerVC

| 2.0.2.1| IT39891| https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EOther%20software&product=ibm/Other+software/PowerVC&release=2.0.2.1&platform=All&function=fixId&fixids=2.0.2.1-PowerVC-RHEL-NOARCH-APAR-IT39891&includeRequisites=0&includeSupersedes=0&downloadMethod=http

Workarounds and Mitigations

None