CVE-2021-3426
published 2021-05-20CVE-2021-3426: There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server…
PriorityP431medium5.7CVSS 3.1
AVAACLPRLUINSUCHINAN
EPSS
1.88%
77.3th percentile
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | pypy3 | < pypy3 7.3.3+dfsg-4 (bookworm) | pypy3 7.3.3+dfsg-4 (bookworm) |
| debian | python2.7 | < pypy3 7.3.3+dfsg-4 (bookworm) | pypy3 7.3.3+dfsg-4 (bookworm) |
| debian | python3.9 | < pypy3 7.3.3+dfsg-4 (bookworm) | pypy3 7.3.3+dfsg-4 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| oracle | communications_cloud_native_core_binding_support_function | — | — |
| oracle | zfs_storage_appliance_kit | — | — |
| python | python | < 2.7.18 | 2.7.18 |
| python | python | — | — |
| python | python | — | — |
| python | python | >= 3.6.0 < 3.6.13 | 3.6.13 |
| python | python | >= 3.7.0 < 3.7.10 | 3.7.10 |
| python | python | >= 3.8.0 < 3.8.8 | 3.8.8 |
| python | python | >= 3.9.0 < 3.9.3 | 3.9.3 |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.15.7MEDIUMCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.7LOWAV:A/AC:L/Au:S/C:P/I:N/A:N
osv7.6HIGH
vendor_ubuntu7.6HIGH
vendor_debian5.7MEDIUM
vendor_oracle5.7MEDIUM
vendor_redhat5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
osv·2024-07-11·CVSS 7.6
CVE-2015-20107 [HIGH] python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 L
GHSA
GHSA-6qp6-q95v-x2qw: There's a flaw in Python 3's pydoc
ghsa_unreviewed·2022-05-24
CVE-2021-3426 [MEDIUM] CWE-200 GHSA-6qp6-q95v-x2qw: There's a flaw in Python 3's pydoc
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
OSV
python3.7 vulnerability
osv·2022-05-23·CVSS 5.7
CVE-2021-3426 [MEDIUM] python3.7 vulnerability
python3.7 vulnerability
USN-5342-1 fixed several vulnerabilities in Python. This update provides
the corresponding fix for CVE-2021-3426 for Ubuntu 18.04 ESM.
Original advisory details:
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
OSV
python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
osv·2022-03-28·CVSS 5.7
CVE-2021-3426 [MEDIUM] python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
python2.7, python3.4, python3.5, python3.6, python3.8 vulnerabilities
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
OSV
CVE-2021-3426: There's a flaw in Python 3's pydoc
osv·2021-05-20·CVSS 5.7
CVE-2021-3426 [MEDIUM] CVE-2021-3426: There's a flaw in Python 3's pydoc
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-07-11·CVSS 7.6
CVE-2021-29921 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2018-14647)
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
cisa_ics·2023-12-14
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Release DateDecember 14, 2023
Alert CodeICSA-23-348-10
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
- Vulnerabilities: Improper Restriction of XML External Entity Reference, Time-of-check Time-of-use (TOCTOU) Race Condition, Command Injection, Miss
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (Python) — CVE-2021-3426
vendor_oracle·2022-10-15·CVSS 5.7
CVE-2021-3426 [MEDIUM] Oracle Oracle Communications Risk Matrix: Configuration (Python) — CVE-2021-3426
Oracle Oracle Communications Risk Matrix: Configuration (Python) vulnerability
CVE: CVE-2021-3426
CVSS: 5.7
Protocol: TCP
Remote exploit: No
Affected versions: Adjacent
Network
Advisory: cpuoct2022 (OCT 2022)
Ubuntu
Python vulnerability
vendor_ubuntu·2022-05-23·CVSS 5.7
CVE-2021-3426 [MEDIUM] Python vulnerability
Title: Python vulnerability
Summary: Python could be made to expose sensitive information.
USN-5342-1 fixed several vulnerabilities in Python. This update provides
the corresponding fix for CVE-2021-3426 for Ubuntu 18.04 ESM.
Original advisory details:
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could pos
Ubuntu
Python vulnerabilities
vendor_ubuntu·2022-03-28·CVSS 5.7
CVE-2022-0391 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
David Schwörer discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2021-3426)
It was discovered that Python incorrectly handled certain FTP requests.
An attacker could possibly use this issue to expose sensitive information.
This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM, and Ubuntu 18.04 LTS.
(CVE-2021-4189)
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
(CVE-2022-0391)
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Communications Risk Matrix: Binding Support Function (Python) — CVE-2021-3426
vendor_oracle·2022-01-15·CVSS 5.7
CVE-2021-3426 [MEDIUM] Oracle Oracle Communications Risk Matrix: Binding Support Function (Python) — CVE-2021-3426
Oracle Oracle Communications Risk Matrix: Binding Support Function (Python) vulnerability
CVE: CVE-2021-3426
CVSS: 5.7
Protocol: Multiple
Remote exploit: No
Affected versions: Adjacent
Network
Advisory: cpujan2022 (JAN 2022)
Red Hat
python: Information disclosure via pydoc
vendor_redhat·2021-03-10·CVSS 5.7
CVE-2021-3426 [MEDIUM] CWE-200 python: Information disclosure via pydoc
python: Information disclosure via pydoc
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
A flaw was found in Python 3's pydoc. This flaw allows a local or adjacent attacker who discovers or can convince another local or adjacent user to start a pydoc server to access the server and then use it to disclose sensitive information belonging to the other user that they would
Debian
CVE-2021-3426: pypy3 - There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers o...
vendor_debian·2021·CVSS 5.7
CVE-2021-3426 [MEDIUM] CVE-2021-3426: pypy3 - There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers o...
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
Scope: local
bookworm: resolved (fixed in 7.3.3+dfsg-4)
bullseye: resolved (fixed in 7.3.3+dfsg-4)
forky: resolved (fixed in 7.3.3+dfsg-4)
sid: resolved (fixed in 7.3.3+dfsg-4)
trixie: resolved (fixed in 7.3.3+dfsg-4)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugzilla.redhat.com/show_bug.cgi?id=1935913https://lists.debian.org/debian-lts-announce/2021/04/msg00005.htmlhttps://lists.debian.org/debian-lts-announce/2023/06/msg00039.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25HVHLBGO2KNPXJ3G426QEYSSCECJDU5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF2K7HEWADHN6P52R3QLIOX27U3DJ4HI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQYPUKLLBOZMKFPO7RD7CENTXHUUEUV7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5V4VPLBHBEASSAROYPSHXGXGGPHNOE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNGAFMPIYIVJ47FCF2NK2PIX22HUG35B/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPX7Y5GQDNB4FJTREWONGC4ZSVH7TGHF/https://security.gentoo.org/glsa/202104-04https://security.netapp.com/advisory/ntap-20210629-0003/https://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1935913https://lists.debian.org/debian-lts-announce/2021/04/msg00005.htmlhttps://lists.debian.org/debian-lts-announce/2023/06/msg00039.htmlhttps://lists.debian.org/debian-lts-announce/2024/12/msg00000.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25HVHLBGO2KNPXJ3G426QEYSSCECJDU5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF2K7HEWADHN6P52R3QLIOX27U3DJ4HI/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQYPUKLLBOZMKFPO7RD7CENTXHUUEUV7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5V4VPLBHBEASSAROYPSHXGXGGPHNOE/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNGAFMPIYIVJ47FCF2NK2PIX22HUG35B/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPX7Y5GQDNB4FJTREWONGC4ZSVH7TGHF/https://security.gentoo.org/glsa/202104-04https://security.netapp.com/advisory/ntap-20210629-0003/https://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.html
2021-05-20
Published