Lack of data validation - Path Traversal In babel
Description
Directory Traversal in Babel Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.17 | 2.9.1-r0 | ||
alpine v3.22 | 2.9.1-r0 | ||
 debian 14 | 2.8.0+dfsg.1-7 | ||
 rpm rhel8 | 0:3.8.8-4.module+el8.5.0+12205+a865257a | ||
 pypi | 2.9.1 | ||
alpine v3.16 | 2.9.1-r0 | ||
alpine v3.18 | 2.9.1-r0 | ||
alpine v3.19 | 2.9.1-r0 | ||
alpine v3.20 | 2.9.1-r0 | ||
debian 13 | 2.8.0+dfsg.1-7 |
1-10 of 18
10
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.
References
1. 2. 3. 4. 5.