CVE-2021-3426Medium· 5.7▾ SunlitThere's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging t…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.4 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.9%
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
python < 2.7.18python >= 3.6.0, < 3.6.13python >= 3.7.0, < 3.7.10python >= 3.8.0, < 3.8.8python >= 3.9.0, < 3.9.3python = 3.10.0fedora = 32fedora = 33fedora = 34debian_linux = 9.0software_collectionsenterprise_linux = 8.0cloud_backupontap_select_deploy_administration_utilitysnapcentercommunications_cloud_native_core_binding_support_function = 1.10.0zfs_storage_appliance_kit = 8.8Upgrade past the affected range:
python 3.9.3Connected by shared product, vendor, weakness, or advisory.
CVE-2021-23336Medium· 5.9The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by usi…
CVE-2021-4189Medium· 5.3A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode
CVE-2021-3737High· 7.5A flaw was found in python
CVE-2021-3177Critical· 9.8Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300…
CVE-2021-29921Critical· 9.8In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string
CVE-2021-3733Medium· 6.5There's a flaw in urllib's AbstractBasicAuthHandler class