GHSA-h4m5-qpfp-3mpv

Directory Traversal in Babel

Source: GitHub Advisory Database (reviewed) High CVE-2021-42771

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	babel	< 2.9.1	2.9.1

Details

As written in the advisory (Markdown source, shown as plain text).

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-42771 advisory
https://github.com/python-babel/babel/pull/782 web
https://github.com/python-babel/babel/commit/412015ef642bfcc0d8ba8f4d05cdbb6aac98d9b3 web
https://github.com/advisories/GHSA-h4m5-qpfp-3mpv advisory
https://github.com/pypa/advisory-database/tree/main/vulns/babel/PYSEC-2021-421.yaml web
https://github.com/python-babel/babel web
https://lists.debian.org/debian-lts-announce/2021/10/msg00018.html web
https://lists.debian.org/debian-lts/2021/10/msg00040.html web
https://www.debian.org/security/2021/dsa-5018 web
https://www.tenable.com/security/research/tra-2021-14 web