diff options
| author | Thomas Zander <riggs@FreeBSD.org> | 2021-04-10 15:05:37 +0800 |
|---|---|---|
| committer | Thomas Zander <riggs@FreeBSD.org> | 2021-04-10 15:13:03 +0800 |
| commit | 1d4cfc12c8fa8c58010c2468a2181bcc96302e36 (patch) | |
| tree | eaeadda7090129607b2b9ec15291ac474cb20247 /security/vuxml | |
| parent | 56f63423a582868c298dbcaed442bc3eddc2937f (diff) | |
| download | freebsd-ports-gnome-1d4cfc12c8fa8c58010c2468a2181bcc96302e36.tar.gz freebsd-ports-gnome-1d4cfc12c8fa8c58010c2468a2181bcc96302e36.tar.zst freebsd-ports-gnome-1d4cfc12c8fa8c58010c2468a2181bcc96302e36.zip | |
security/vuxml: Document information disclosure vulnerability in python.
PR: 254780
Reported by: yasu@utahime.org
Security: CVE-2021-3426
Diffstat (limited to 'security/vuxml')
| -rw-r--r-- | security/vuxml/vuln.xml | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 6a2eb8116567..07859bf2010c 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -76,6 +76,42 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="f671c282-95ef-11eb-9c34-080027f515ea"> + <topic>python -- Information disclosure via pydoc -p: /getfile?key=path allows to read arbitrary file on the filesystem</topic> + <affects> + <package> + <name>python38</name> + <range><lt>3.8.9</lt></range> + </package> + <package> + <name>python39</name> + <range><lt>3.9.3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>David Schwörer reports:</p> + <blockquote cite="https://pythoninsider.blogspot.com/2021/04/python-393-and-389-are-now-available.html"> + <p> + Remove the getfile feature of the pydoc module which could be + abused to read arbitrary files on the disk (directory traversal + vulnerability). Moreover, even source code of Python modules + can contain sensitive data like passwords. + </p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2021-3426</cvename> + <url>https://pythoninsider.blogspot.com/2021/04/python-393-and-389-are-now-available.html</url> + <url>https://bugs.python.org/issue42988</url> + </references> + <dates> + <discovery>2021-01-21</discovery> + <entry>2021-04-10</entry> + </dates> + </vuln> + <vuln vid="d10fc771-958f-11eb-9c34-080027f515ea"> <topic>curl -- TLS 1.3 session ticket proxy host mixup</topic> <affects> |