Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
91
security advisorygentooremote code executionGentoo GLSA-202208-03: Babel Remote Code Execution Notification
A vulnerability in Babel could result in remote code execution.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202208-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Babel: Remote code execution Date: August 04, 2022 Bugs: #786954 ID: 202208-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in Babel could result in remote code execution. Background ========= Babel is a collection of tools for internationalizing Python applications. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-python/Babel < 2.9.1 > = 2.9.1 Description ========== Babel does not properly restrict which sources a locale can be loaded from. If Babel loads an attacker-controlled .dat file, arbitrary code execution can be achieved via unsafe Pickle deserialization. Impact ===== An attacker with filesystem access and control over the locales Babel loads can achieve code execution. Workaround ========= There is no known workaround at this time. Resolution ========= All Babel users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-python/Babel-2.9.1" References ========= [ 1 ] CVE-2021-20095 https://nvd.nist.gov/vuln/detail/CVE-2021-20095 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202208-03 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuringthe confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Aug 04, 2022
Gentoo
98
security advisorysecurity issuebug fixRed Hat Enterprise Linux 8 RHSA-2021-4201-04 Moderate Path Traversal Risk
An update for babel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: babel security and bug fix update Advisory ID: RHSA-2021:4201-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4201 Issue date: 2021-11-09 CVE Names: CVE-2021-20095 CVE-2021-42771 ==================================================================== 1. Summary: An update for babel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - noarch 3. Description: Babel provides tools to build and work with gettext message catalogs, and a Python interface to the CLDR (Common Locale Data Repository), providing access to various locale display names, localized number and date formatting, etc. Security Fix(es): * python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code (CVE-2021-20095, CVE-2021-42771) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. 4.Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1955615 - CVE-2021-20095 CVE-2021-42771 python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: babel-2.5.1-7.el8.src.rpm noarch: python3-babel-2.5.1-7.el8.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2021-20095 https://access.redhat.com/security/cve/CVE-2021-42771 https://access.redhat.com/security/updates/classification#moderate https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/8.5_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYrc+dzjgjWX9erEAQirpA/9FNeBoOCICxH1bgmO/YIiPfQSOqOsP1Hp VoeY9TJsN1AQ3ccv4ZWbrifmzUp/x8FhWBwUHexzbQhyemNUAQVz99ZlWwsxTsx9 vU8vxqOCDPh31becqeBlf+RFWv9sybKD06lPJQml/2du++2lGrhGhvljZSl+EUHf xMS1oxY9elEppPiTxNnkQSC+67YxA6wNS2N+xMm2W73L53CXnh/dC0C+FeKiTS6B FedCDHrLQK0WMSlBONIuIhDV3/ya9f3lbCiWXQY1lNHtKtyEPItC06jwM4mXrXnD p8HwMbKZCCH3rsDf84qP7AJBOwkSoeEf3bSC6QmMPo0zV+mfSxuoIkPylTKqV0Nc 2COjfF8Xu6JRpGk7tqKw8NBUoU+tGuFZkicfQymGhsbsWHTcWdgMfyLmvIgknYSe ABZOZSZDAKskI03BkYaVdVwTsBIVTWZmnRgQ5BMwdX9Xhn6Nc0+FJwNUEmkoKb0r daxiRSaUUXvoAP9vzf1NOB9Di4uznER937eQcwBUWeh9vXhOjWcQM9o1F+PR8DV1 l9qPYBqfcIG3H76yoxrNa9Vg2wX/I0P461rk43JJwMf0nPmMV7VzmWQ7nFF8Ohcx b0eQIfwPgtxaulUfFAoq+jLpUsEYnZifeug6uaISl1G3+lrv9WINacyo1tp6R9sO Hbww/bBUxdI=5taA -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Nov 09, 2021
Red Hat
89
security advisorysecurity issuecriticalUbuntu 20.04: 2021-8d2c4a3f06 High: Node.js CVE-2021-22918 Update
backported fix for CVE-2021-20095 from Babel 2.9.1. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-7e2a143808 2021-05-09 00:51:04.840473 --------------------------------------------------------------------------------Name : babel Product : Fedora 32 Version : 2.8.0 Release : 4.fc32 URL : https://babel.pocoo.org/en/latest/ Summary : Tools for internationalizing Python applications Description : Babel is composed of two major parts: * tools to build and work with gettext message catalogs * a Python interface to the CLDR (Common Locale Data Repository), providing access to various locale display names, localized number and date formatting, etc. --------------------------------------------------------------------------------Update Information: backported fix for CVE-2021-20095 from Babel 2.9.1 --------------------------------------------------------------------------------ChangeLog: * Fri Apr 30 2021 Felix Schwarz - 2.8.1-2 - backport fix for CVE-2021-20095 from Babel 2.9.1 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-7e2a143808' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
May 08, 2021
•Important
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!