-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: babel security and bug fix update Advisory ID: RHSA-2021:4201-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4201 Issue date: 2021-11-09 CVE Names: CVE-2021-20095 CVE-2021-42771 ==================================================================== 1. Summary: An update for babel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - noarch 3. Description: Babel provides tools to build and work with gettext message catalogs, and a Python interface to the CLDR (Common Locale Data Repository), providing access to various locale display names, localized number and date formatting, etc. Security Fix(es): * python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code (CVE-2021-20095, CVE-2021-42771) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1955615 - CVE-2021-20095 CVE-2021-42771 python-babel: Relative path traversal allows attacker to load arbitrary locale files and execute arbitrary code 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: babel-2.5.1-7.el8.src.rpm noarch: python3-babel-2.5.1-7.el8.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-20095 https://access.redhat.com/security/cve/CVE-2021-42771 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYrc+dzjgjWX9erEAQirpA/9FNeBoOCICxH1bgmO/YIiPfQSOqOsP1Hp VoeY9TJsN1AQ3ccv4ZWbrifmzUp/x8FhWBwUHexzbQhyemNUAQVz99ZlWwsxTsx9 vU8vxqOCDPh31becqeBlf+RFWv9sybKD06lPJQml/2du++2lGrhGhvljZSl+EUHf xMS1oxY9elEppPiTxNnkQSC+67YxA6wNS2N+xMm2W73L53CXnh/dC0C+FeKiTS6B FedCDHrLQK0WMSlBONIuIhDV3/ya9f3lbCiWXQY1lNHtKtyEPItC06jwM4mXrXnD p8HwMbKZCCH3rsDf84qP7AJBOwkSoeEf3bSC6QmMPo0zV+mfSxuoIkPylTKqV0Nc 2COjfF8Xu6JRpGk7tqKw8NBUoU+tGuFZkicfQymGhsbsWHTcWdgMfyLmvIgknYSe ABZOZSZDAKskI03BkYaVdVwTsBIVTWZmnRgQ5BMwdX9Xhn6Nc0+FJwNUEmkoKb0r daxiRSaUUXvoAP9vzf1NOB9Di4uznER937eQcwBUWeh9vXhOjWcQM9o1F+PR8DV1 l9qPYBqfcIG3H76yoxrNa9Vg2wX/I0P461rk43JJwMf0nPmMV7VzmWQ7nFF8Ohcx b0eQIfwPgtxaulUfFAoq+jLpUsEYnZifeug6uaISl1G3+lrv9WINacyo1tp6R9sO Hbww/bBUxdI=5taA -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce