First published: Fri Mar 05 2021(Updated: )
A flaw was found in Python 3's pydoc. This flaw allows a local or adjacent attacker who discovers or can convince another local or adjacent user to start a pydoc server to access the server and then use it to disclose sensitive information belonging to the other user that they would not normally have the ability to access. The highest threat from this vulnerability is to data confidentiality.
Credit: secalert@redhat.com secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/python3 | <0:3.6.8-41.el8 | 0:3.6.8-41.el8 |
redhat/rh-python38-babel | <0:2.7.0-12.el7 | 0:2.7.0-12.el7 |
redhat/rh-python38-python | <0:3.8.11-2.el7 | 0:3.8.11-2.el7 |
redhat/rh-python38-python-cryptography | <0:2.8-5.el7 | 0:2.8-5.el7 |
redhat/rh-python38-python-jinja2 | <0:2.10.3-6.el7 | 0:2.10.3-6.el7 |
redhat/rh-python38-python-lxml | <0:4.4.1-7.el7 | 0:4.4.1-7.el7 |
redhat/rh-python38-python-pip | <0:19.3.1-2.el7 | 0:19.3.1-2.el7 |
redhat/rh-python38-python-urllib3 | <0:1.25.7-7.el7 | 0:1.25.7-7.el7 |
Python Python | <2.7.18 | |
Python Python | >=3.6.0<3.6.13 | |
Python Python | >=3.7.0<3.7.10 | |
Python Python | >=3.8.0<3.8.8 | |
Python Python | >=3.9.0<3.9.3 | |
Python Python | =3.10.0-alpha1 | |
Python Python | =3.10.0-alpha2 | |
Python Python | =3.10.0-alpha3 | |
Python Python | =3.10.0-alpha4 | |
Python Python | =3.10.0-alpha5 | |
Python Python | =3.10.0-alpha6 | |
Fedoraproject Fedora | =32 | |
Fedoraproject Fedora | =33 | |
Fedoraproject Fedora | =34 | |
Debian Debian Linux | =9.0 | |
Redhat Software Collections | ||
Redhat Enterprise Linux | =8.0 | |
Netapp Cloud Backup | ||
NetApp ONTAP Select Deploy administration utility | ||
Netapp Snapcenter | ||
Oracle Communications Cloud Native Core Binding Support Function | =1.10.0 | |
Oracle ZFS Storage Appliance Kit | =8.8 | |
redhat/python | <3.8.9 | 3.8.9 |
redhat/python | <3.9.3 | 3.9.3 |
redhat/python | <3.10.0 | 3.10.0 |
IBM Cloud Pak for Security | <=1.10.0.0 - 1.10.11.0 | |
IBM QRadar Suite Software | <=1.10.12.0 - 1.10.16.0 | |
debian/pypy3 | 7.3.5+dfsg-2+deb11u2 7.3.11+dfsg-2+deb12u2 7.3.17+dfsg-2 | |
debian/python2.7 | 2.7.18-8+deb11u1 | |
debian/python3.9 | <=3.9.2-1 |
Use the console (no argument needed) or HTML file (-w argument) output to generate docs rather than the HTTP server options. Put differently, do not use the -p or -n options of pydoc.
Do not expose the pydoc webserver to untrusted users.
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
CVE-2021-3426 is a vulnerability in Python 3's pydoc that allows a local or adjacent attacker to access and disclose sensitive information belonging to another user.
CVE-2021-3426 affects Python 3 versions 3.8.9, 3.9.3, and 3.10.0.
The CVE-2021-3426 vulnerability can be exploited by a local or adjacent attacker who starts a pydoc server and convinces another user to access it, thereby allowing the attacker to access sensitive information.
CVE-2021-3426 has a severity rating of 5.7 (Medium).
To fix the CVE-2021-3426 vulnerability, it is recommended to update Python 3 to versions 3.8.9, 3.9.3, or 3.10.0.