Arch Linux Security Advisory ASA-202105-15

Severity: Medium
Date : 2021-05-19
CVE-ID : CVE-2021-20095
Package : python-babel
Type : arbitrary code execution
Remote : No
Link : https://security.archlinux.org/AVG-1894

Summary

The package python-babel before version 2.9.1-1 is vulnerable to
arbitrary code execution.

Resolution

Upgrade to 2.9.1-1.

pacman -Syu “python-babel>=2.9.1-1”

The problem has been fixed upstream in version 2.9.1.

Workaround

None.

Description

Relative Path Traversal in Babel 2.9.0 allows an attacker to load
arbitrary locale files on disk and execute arbitrary code.

Impact

A local attacker could load arbitrary locale files through path
traversal using a crafted locale identifier and execute arbitrary code.

References

https://www.tenable.com/security/research/tra-2021-14
https://github.com/python-babel/babel/pull/782
https://github.com/python-babel/babel/commit/412015ef642bfcc0d8ba8f4d05cdbb6aac98d9b3
https://security.archlinux.org/CVE-2021-20095