Bug 1185768 (CVE-2021-42771) - VUL-0: CVE-2021-42771: python-Babel: relative path traversal leads to load arbitrary locale files on disk and execute arbitrary code
Summary: VUL-0: CVE-2021-42771: python-Babel: relative path traversal leads to load ar...
Status: RESOLVED FIXED
Alias: CVE-2021-42771
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P2 - High : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/283261/
Whiteboard: CVSSv3.1:SUSE:CVE-2021-20095:7.8:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2021-05-07 10:30 UTC by Gianluca Gabrielli
Modified: 2024-05-13 12:46 UTC (History)
9 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Gianluca Gabrielli 2021-05-07 10:30:26 UTC
CVE-2021-20095

Relative Path Traversal in Babel 2.9.0 allows an attacker to load arbitrary locale files on disk and execute arbitrary code.

Reference:
https://www.tenable.com/security/research/tra-2021-14

Upstream patch:
https://github.com/python-babel/babel/pull/782

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1955615
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20095
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20095
https://www.tenable.com/security/research/tra-2021-14
Comment 1 Gianluca Gabrielli 2021-05-07 10:33:03 UTC
Affected packages:

SUSE:SLE-12-SP1:Update/python-Babel                           2.5.3
SUSE:SLE-12-SP2:Update:Products:Cloud7:Update/python-Babel    2.3.4
SUSE:SLE-12-SP3:Update:Products:Cloud8:Update/python-Babel    2.3.4
SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/python-Babel    2.5.1
SUSE:SLE-15-SP2:Update/python-Babel                           2.8.0
SUSE:SLE-15:Update/python-Babel                               2.5.1
openSUSE:Factory/python-Babel                                 2.9.0

Upstream patch here [0].

[0] https://github.com/python-babel/babel/commit/412015ef642bfcc0d8ba8f4d05cdbb6aac98d9b3.patch
Comment 2 Gianluca Gabrielli 2021-06-17 18:00:55 UTC
CVE-2021-20095 appers to have been rejected again "This candidate was withdrawn by its CNA" according to https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20095
Comment 3 Gianluca Gabrielli 2021-06-22 12:03:04 UTC
CVE rejected by Tenable Network Security, Inc.
Comment 4 Gianluca Gabrielli 2021-10-21 08:07:49 UTC
Beuc from the Debian LTS team requested a new CVE to Mitre [0]. This security bug is now tracked with CVE-2021-42771 [1].

@Matej: please backport the fix to the affected packages as stated in comment 1.

[0] https://github.com/python-babel/babel/pull/782#issuecomment-948346895
[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42771
Comment 7 OBSbugzilla Bot 2021-10-29 22:40:07 UTC
This is an autogenerated message for OBS integration:
This bug (1185768) was mentioned in
https://build.opensuse.org/request/show/928218 Factory / python-Babel
Comment 11 Gianluca Gabrielli 2021-11-29 08:11:18 UTC
(In reply to Gianluca Gabrielli from comment #1)
> Affected packages:
> 
> SUSE:SLE-12-SP1:Update/python-Babel                           2.5.3
> SUSE:SLE-12-SP2:Update:Products:Cloud7:Update/python-Babel    2.3.4
> SUSE:SLE-12-SP3:Update:Products:Cloud8:Update/python-Babel    2.3.4
> SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/python-Babel    2.5.1
> SUSE:SLE-15-SP2:Update/python-Babel                           2.8.0
> SUSE:SLE-15:Update/python-Babel                               2.5.1
> openSUSE:Factory/python-Babel                                 2.9.0

From the previous list (shared in May) you can now ignore:
 - SUSE:SLE-12-SP2:Update:Products:Cloud7:Update/python-Babel
 - SUSE:SLE-15:Update/python-Babel
 - openSUSE:Factory/python-Babel

Since you already submitted to:
 - SUSE:SLE-12-SP1:Update/python-Babel
 - SUSE:SLE-15-SP2:Update/python-Babel

Only the following codestream are missing submissions:
 - SUSE:SLE-12-SP3:Update:Products:Cloud8:Update/python-Babel
 - SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/python-Babel

that, correct me if I'm wrong, the cloud team should provide.
Comment 12 Swamp Workflow Management 2021-12-06 17:21:24 UTC
openSUSE-SU-2021:3945-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1185768
CVE References: CVE-2021-42771
JIRA References: 
Sources used:
openSUSE Leap 15.3 (src):    python-Babel-2.8.0-3.3.1, python-Babel-doc-2.8.0-3.3.1
Comment 13 Swamp Workflow Management 2021-12-06 18:29:07 UTC
SUSE-SU-2021:3945-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1185768
CVE References: CVE-2021-42771
JIRA References: 
Sources used:
SUSE MicroOS 5.1 (src):    python-Babel-2.8.0-3.3.1
SUSE MicroOS 5.0 (src):    python-Babel-2.8.0-3.3.1
SUSE Linux Enterprise Module for Python2 15-SP3 (src):    python-Babel-2.8.0-3.3.1
SUSE Linux Enterprise Module for Python2 15-SP2 (src):    python-Babel-2.8.0-3.3.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    python-Babel-2.8.0-3.3.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    python-Babel-2.8.0-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2021-12-10 14:22:51 UTC
openSUSE-SU-2021:1553-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1185768
CVE References: CVE-2021-42771
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    python-Babel-2.8.0-lp152.2.3.1, python-Babel-doc-2.8.0-lp152.2.3.1
Comment 17 Swamp Workflow Management 2021-12-22 20:16:45 UTC
SUSE-SU-2021:4161-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1185768
CVE References: CVE-2021-42771
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Public Cloud 12 (src):    python-Babel-2.5.3-4.8.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 18 Swamp Workflow Management 2022-01-05 20:19:06 UTC
SUSE-SU-2022:0029-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1185768
CVE References: CVE-2021-42771
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    python-Babel-2.3.4-4.3.1
SUSE OpenStack Cloud 8 (src):    python-Babel-2.3.4-4.3.1
HPE Helion Openstack 8 (src):    python-Babel-2.3.4-4.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 19 Swamp Workflow Management 2022-01-05 20:20:17 UTC
SUSE-SU-2022:0028-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1185768
CVE References: CVE-2021-42771
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    python-Babel-2.5.1-3.3.1
SUSE OpenStack Cloud 9 (src):    python-Babel-2.5.1-3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 23 Swamp Workflow Management 2022-10-14 13:26:44 UTC
SUSE-SU-2022:3590-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1185768
CVE References: CVE-2021-42771
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    python-Babel-2.5.1-150000.3.3.1
SUSE Linux Enterprise Server for SAP 15 (src):    python-Babel-2.5.1-150000.3.3.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    python-Babel-2.5.1-150000.3.3.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    python-Babel-2.5.1-150000.3.3.1
SUSE Linux Enterprise Server 15-LTSS (src):    python-Babel-2.5.1-150000.3.3.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    python-Babel-2.5.1-150000.3.3.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    python-Babel-2.5.1-150000.3.3.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    python-Babel-2.5.1-150000.3.3.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    python-Babel-2.5.1-150000.3.3.1
SUSE Enterprise Storage 6 (src):    python-Babel-2.5.1-150000.3.3.1
SUSE CaaS Platform 4.0 (src):    python-Babel-2.5.1-150000.3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 24 OBSbugzilla Bot 2023-09-05 15:05:03 UTC
This is an autogenerated message for OBS integration:
This bug (1185768) was mentioned in
https://build.opensuse.org/request/show/1109065 Factory / python-Babel