CVE-2021-3426 Information disclosure in python
A local attacker can access sensitive information from a running pydoc server, compromising data confidentiality for other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3426?
CVE-2021-3426 is a medium-severity vulnerability in Debian Debian Linux, published on 20 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
Which versions are affected by CVE-2021-3426?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 10 products.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 2.7.18, 3.6.13, 3.7.10, 3.8.8, 3.9.3 |
python Bitnami | All versions | 2.7.18, 3.6.13, 3.7.10, 3.8.8, 3.9.3 |
python-min Bitnami | All versions | 2.7.18, 3.6.13, 3.7.10, 3.8.8, 3.9.3 |
Linux distribution packages (37)
platform-python AlmaLinux:8 | All versions | 3.6.8-41.el8 |
platform-python AlmaLinux:8 | All versions | 3.6.8-41.el8.alma |
platform-python-debug AlmaLinux:8 | All versions | 3.6.8-41.el8 |
platform-python-debug AlmaLinux:8 | All versions | 3.6.8-41.el8.alma |
platform-python-devel AlmaLinux:8 | All versions | 3.6.8-41.el8 |
platform-python-devel AlmaLinux:8 | All versions | 3.6.8-41.el8.alma |
python3-idle AlmaLinux:8 | All versions | 3.6.8-41.el8 |
python3-idle AlmaLinux:8 | All versions | 3.6.8-41.el8.alma |
python3-test AlmaLinux:8 | All versions | 3.6.8-41.el8 |
python3-test AlmaLinux:8 | All versions | 3.6.8-41.el8.alma |
python3-tkinter AlmaLinux:8 | All versions | 3.6.8-41.el8 |
python3-tkinter AlmaLinux:8 | All versions | 3.6.8-41.el8.alma |
platform-python Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-41.el8 |
platform-python-debug Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-41.el8 |
platform-python-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-41.el8 |
python3-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-41.el8 |
python3-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-41.el8 |
python3-idle Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-41.el8 |
python3-test Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-41.el8 |
python3-tkinter Red Hat:enterprise_linux:8::appstream | All versions | 0:3.6.8-41.el8 |
platform-python Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.8-41.el8 |
python3 Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.8-41.el8 |
python3-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.8-41.el8 |
python3-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.8-41.el8 |
python3-libs Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.8-41.el8 |
python3-test Red Hat:enterprise_linux:8::baseos | All versions | 0:3.6.8-41.el8 |
python3 SUSE:Linux Enterprise Micro 5.0 | All versions | 3.6.13-3.81.2 |
python3-core SUSE:Linux Enterprise Micro 5.0 | All versions | 3.6.13-3.81.1 |
python3 SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 3.6.13-3.81.2 |
python3-core SUSE:Linux Enterprise Module for Basesystem 15 SP2 | All versions | 3.6.13-3.81.1 |
python3 SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 3.6.13-3.81.2 |
python3-core SUSE:Linux Enterprise Module for Basesystem 15 SP3 | All versions | 3.6.13-3.81.1 |
python3-core SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 3.6.13-3.81.1 |
python3-core SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 3.6.13-3.81.1 |
python36 SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.6.13-4.39.1 |
python36-core SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.6.13-4.39.1 |
python36 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.6.13-4.39.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Netapp Cloud Backup, Netapp Ontap Select Deploy Administration Utility, Netapp Snapcenter, Oracle Communications Cloud Native Core Binding Support Function and 4 more.
How do I fix CVE-2021-3426?
Upgrade libpython to a fixed version for your release line: 2.7.18, 3.6.13, 3.7.10 or 3.8.8.
Is CVE-2021-3426 being exploited?
There is no known exploitation of CVE-2021-3426 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2021-3426, ALSA-2021:4399, AZL-109635, BIT-libpython-2021-3426, BIT-python-2021-3426, BIT-python-min-2021-3426 and 14 more.