CVE-2021-3426: Path Traversal
A flaw was found in Python 3's pydoc. This flaw allows a local or adjacent attacker who discovers or can convince another local or adjacent user to start a pydoc server to access the server and then use it to disclose sensitive information belonging to the other user that they would not normally have the ability to access. The highest threat from this vulnerability is to data confidentiality.
Other sources
Python pydoc module could allow a remote attacker from within the local network obtain sensitive information. By starting the pydoc server, an attacker could exploit this vulnerability to extract arbitrary files.
— IBM
Running pydoc -p allows other local users to extract arbitrary files
— Red Hat
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.
Affected Software
Remediation
Information
Patch Available
Patch Available
Patch Available
Mitigation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3426?
CVE-2021-3426 is a vulnerability in Python 3's pydoc that allows a local or adjacent attacker to access and disclose sensitive information belonging to another user.
How does CVE-2021-3426 affect Python 3?
CVE-2021-3426 affects Python 3 versions 3.8.9, 3.9.3, and 3.10.0.
How can the CVE-2021-3426 vulnerability be exploited?
The CVE-2021-3426 vulnerability can be exploited by a local or adjacent attacker who starts a pydoc server and convinces another user to access it, thereby allowing the attacker to access sensitive information.
What is the severity of CVE-2021-3426?
CVE-2021-3426 has a severity rating of 5.7 (Medium).
How can I fix the CVE-2021-3426 vulnerability?
To fix the CVE-2021-3426 vulnerability, it is recommended to update Python 3 to versions 3.8.9, 3.9.3, or 3.10.0.