Arbitrary Locale File Loading Vulnerability in Python-Babel
Summary
DEBIAN-CVE-2021-42771: Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution. Affects python-babel versions < 2.8.0+dfsg.1-7. Fixed in 2.8.0+dfsg.1-7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Babel is a library that provides internationalization (i18n) and localization (l10n) support for Python applications. It allows developers to manage translations, date formatting, and number formatting in various languages. The library is widely used in applications that require multi-language support. However, prior to version 2.9.1, Python-Babel had a vulnerability that allowed attackers to exploit the loading of locale .dat files, potentially leading to severe security risks.
Vulnerability Detail
Babel.Locale in Babel before version 2.9.1 allows attackers to load arbitrary locale .dat files through directory traversal. This vulnerability can lead to code execution by loading serialized Python objects from untrusted sources. The issue arises from improper validation of file paths, enabling attackers to manipulate the file system and execute malicious code.
How To Fix
Minimum fixed version
2.8.0+dfsg.1-7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-babelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid loading locale .dat files from untrusted sources. Ensure that your application only accesses locale files from a secure and validated directory to minimize the risk of exploitation.
Conclusion
The vulnerability in Python-Babel allows for arbitrary code execution through improper handling of locale .dat files. It is crucial to update to the latest version to protect your application from potential exploitation. Implementing workarounds and monitoring your application for vulnerabilities can further enhance security.
See every vulnerability recorded for python-babel →
FAQ
The vulnerability allows attackers to execute arbitrary code on the server by loading malicious .dat files, which can compromise the entire application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
All versions of Python-Babel prior to 2.9.1 are affected by this vulnerability.
Yes, you can mitigate the risk by ensuring that your application does not load locale files from untrusted sources.
If you cannot update the package immediately, implement strict file access controls and validate all file paths to prevent unauthorized access.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-babel.
