Critical Information Disclosure Vulnerability in Python Packages
Summary
UBUNTU-CVE-2021-3426: There's a flaw in Python 3's pydoc. Affects python3.4 versions < 3.4.3-1ubuntu1~14.04.7+esm12. Fixed in 3.4.3-1ubuntu1~14.04.7+esm12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is commonly used for web development, data analysis, artificial intelligence, and more. The affected packages, including python3.4, python3.5, python3.6, python3.7, python3.8, and python3.9, are essential components of the Python ecosystem, providing various functionalities for developers. This vulnerability affects these packages by allowing unauthorized access to sensitive information through a flaw in the pydoc server.
Vulnerability Detail
There's a flaw in Python 3's pydoc that allows a local or adjacent attacker to access a pydoc server started by another user. This could lead to the disclosure of sensitive information that the attacker would not normally be able to access. The vulnerability affects Python versions prior to 3.8.9, 3.9.3, and 3.10.0a7. The highest risk associated with this flaw is to data confidentiality, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
3.4.3-1ubuntu1~14.04.7+esm12
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid starting the pydoc server or ensure that it is not accessible to unauthorized users. Additionally, running the server in a restricted environment can help mitigate the risk until the packages are updated.
Conclusion
In summary, the vulnerability in Python's pydoc server poses a significant risk to data confidentiality. Users are strongly advised to update their Python packages to the latest patched versions to mitigate this risk. Additionally, temporary workarounds can help reduce exposure until updates are applied.
See every vulnerability recorded for python3.4 →
FAQ
The CVSS score of this vulnerability is 5.7, indicating a medium severity level.
The vulnerability affects Python versions prior to 3.8.9, 3.9.3, and 3.10.0a7.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The main consequence is the potential disclosure of sensitive information, which could compromise data confidentiality.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python3.4.
