CVE-2021-3426

MEDIUM

Python < 3.8.9, < 3.9.3, < 3.10.0a7 - Information Disclosure via pydoc Server

Title source: llm
STIX 2.1

Description

There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.

References (15)

Core 15
Core References
Mailing List, Third Party Advisory mailing-list
https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
Third Party Advisory vendor-advisory
https://security.gentoo.org/glsa/202104-04
Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1935913

Scores

CVSS v3 5.7
EPSS 0.0008
EPSS Percentile 23.7%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22 CWE-200
Status published
Products (13)
debian/debian_linux 9.0
fedoraproject/fedora 32
fedoraproject/fedora 33
fedoraproject/fedora 34
netapp/cloud_backup
netapp/ontap_select_deploy_administration_utility
netapp/snapcenter
oracle/communications_cloud_native_core_binding_support_function 1.10.0
oracle/zfs_storage_appliance_kit 8.8
python/python 3.10.0 alpha1 (6 CPE variants)
... and 3 more
Published May 20, 2021
Tracked Since Feb 18, 2026