CVE-2021-3426
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to
02 Description
There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
- EPSS probability
- 1.87% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 79.2% of scored records. A rank, not a probability.
- NVD base score
- 5.7 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-10-14.
- Red Hat severity
- Moderate. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2021-05-20 00:00Z5 YR AGO
- Last updated
- 2026-10-14 09:49Z15 DAYS AGO
- Reserved
- 2021-03-09
- Assigning CNA
- redhat
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 5.7)
- CNA CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- Data version
- 5.2
- Document digest
- e2e43866537c840c54d1df1387b5d8186901d6a57e12e3b67fb95e9ed9856b62
05 Affected products
06 References
- lists.debian.org[debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security updatehttps://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
- lists.fedoraproject.orgFEDORA-2021-a311bf10d4https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/25HVHLBGO2KNPXJ3G426QEYSSCECJDU5/
- lists.fedoraproject.orgFEDORA-2021-2ab6f060d9https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPX7Y5GQDNB4FJTREWONGC4ZSVH7TGHF/
- lists.fedoraproject.orgFEDORA-2021-1769a23935https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DQYPUKLLBOZMKFPO7RD7CENTXHUUEUV7/
- lists.fedoraproject.orgFEDORA-2021-b6b6093b3ahttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/
- lists.fedoraproject.orgFEDORA-2021-067c9deff1https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNGAFMPIYIVJ47FCF2NK2PIX22HUG35B/
- lists.fedoraproject.orgFEDORA-2021-0a8f3ffbc0https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BF2K7HEWADHN6P52R3QLIOX27U3DJ4HI/
- lists.fedoraproject.orgFEDORA-2021-a26257ccf5https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LM5V4VPLBHBEASSAROYPSHXGXGGPHNOE/
- security.gentoo.orgGLSA-202104-04https://security.gentoo.org/glsa/202104-04
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1935913
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2021.html
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20210629-0003/
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2022.html
- lists.debian.org[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security updatehttps://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-398330.html
07 Fixed in
AlmaLinux 8
- platform-python Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- platform-python-debug Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- platform-python-devel Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- python3-idle Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- python3-test Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- python3-tkinter Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- python38-Cython Fixed in 0.29.14-4.module_el8.6.0+2778+cd494b30
- python38-PyMySQL Fixed in 0.10.1-1.module_el8.6.0+2778+cd494b30
- python38-asn1crypto Fixed in 1.2.0-3.module_el8.6.0+2778+cd494b30
- python38-atomicwrites Fixed in 1.3.0-8.module_el8.6.0+2778+cd494b30
- python38-attrs Fixed in 19.3.0-3.module_el8.6.0+2778+cd494b30
- python38-babel Fixed in 2.7.0-11.module_el8.6.0+2778+cd494b30
- python38-cffi Fixed in 1.13.2-3.module_el8.6.0+2778+cd494b30
- python38-chardet Fixed in 3.0.4-19.module_el8.6.0+2778+cd494b30
- python38-cryptography Fixed in 2.8-3.module_el8.6.0+2778+cd494b30
- python38-idna Fixed in 2.8-6.module_el8.6.0+2778+cd494b30
- python38-jinja2 Fixed in 2.10.3-5.module_el8.6.0+2778+cd494b30
- python38-markupsafe Fixed in 1.1.1-6.module_el8.6.0+2778+cd494b30
- python38-mod_wsgi Fixed in 4.6.8-3.module_el8.6.0+2778+cd494b30
- python38-more-itertools Fixed in 7.2.0-5.module_el8.6.0+2778+cd494b30
- python38-numpy Fixed in 1.17.3-6.module_el8.6.0+2778+cd494b30
- python38-numpy-doc Fixed in 1.17.3-6.module_el8.6.0+2778+cd494b30
- python38-numpy-f2py Fixed in 1.17.3-6.module_el8.6.0+2778+cd494b30
- python38-packaging Fixed in 19.2-3.module_el8.6.0+2778+cd494b30
- python38-pluggy Fixed in 0.13.0-3.module_el8.6.0+2778+cd494b30
- python38-ply Fixed in 3.11-10.module_el8.6.0+2778+cd494b30
- python38-psutil Fixed in 5.6.4-4.module_el8.6.0+2778+cd494b30
- python38-psycopg2 Fixed in 2.8.4-4.module_el8.6.0+2778+cd494b30
- python38-psycopg2-doc Fixed in 2.8.4-4.module_el8.6.0+2778+cd494b30
- python38-psycopg2-tests Fixed in 2.8.4-4.module_el8.6.0+2778+cd494b30
- python38-py Fixed in 1.8.0-8.module_el8.6.0+2778+cd494b30
- python38-pycparser Fixed in 2.19-3.module_el8.6.0+2778+cd494b30
- python38-pyparsing Fixed in 2.4.5-3.module_el8.6.0+2778+cd494b30
- python38-pysocks Fixed in 1.7.1-4.module_el8.6.0+2778+cd494b30
- python38-pytest Fixed in 4.6.6-3.module_el8.6.0+2778+cd494b30
- python38-pytz Fixed in 2019.3-3.module_el8.6.0+2778+cd494b30
- python38-pyyaml Fixed in 5.4.1-1.module_el8.6.0+2778+cd494b30
- python38-requests Fixed in 2.22.0-9.module_el8.6.0+2778+cd494b30
- python38-scipy Fixed in 1.3.1-4.module_el8.6.0+2778+cd494b30
- python38-setuptools Fixed in 41.6.0-5.module_el8.6.0+2778+cd494b30
42 further packages in AlmaLinux 8 not shown (first 40 listed).
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Arch Linux
- python Fixed in 3.9.3-1
Source: Arch Linux Security Tracker, the Arch Linux security team. Reformatted by exploit.cc.
CloudLinux 8
- platform-python Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- platform-python-debug Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- platform-python-devel Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- python3-idle Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- python3-test Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- python3-tkinter Fixed
A version is affected if any line below covers it.
- Affected before 3.6.8-41.el8
- Affected before 3.6.8-41.el8.alma
- python38-Cython Fixed in 0.29.14-4.module_el8.6.0+2778+cd494b30
- python38-PyMySQL Fixed in 0.10.1-1.module_el8.6.0+2778+cd494b30
- python38-asn1crypto Fixed in 1.2.0-3.module_el8.6.0+2778+cd494b30
- python38-atomicwrites Fixed in 1.3.0-8.module_el8.6.0+2778+cd494b30
- python38-attrs Fixed in 19.3.0-3.module_el8.6.0+2778+cd494b30
- python38-babel Fixed in 2.7.0-11.module_el8.6.0+2778+cd494b30
- python38-cffi Fixed in 1.13.2-3.module_el8.6.0+2778+cd494b30
- python38-chardet Fixed in 3.0.4-19.module_el8.6.0+2778+cd494b30
- python38-cryptography Fixed in 2.8-3.module_el8.6.0+2778+cd494b30
- python38-idna Fixed in 2.8-6.module_el8.6.0+2778+cd494b30
- python38-jinja2 Fixed in 2.10.3-5.module_el8.6.0+2778+cd494b30
- python38-markupsafe Fixed in 1.1.1-6.module_el8.6.0+2778+cd494b30
- python38-mod_wsgi Fixed in 4.6.8-3.module_el8.6.0+2778+cd494b30
- python38-more-itertools Fixed in 7.2.0-5.module_el8.6.0+2778+cd494b30
- python38-numpy Fixed in 1.17.3-6.module_el8.6.0+2778+cd494b30
- python38-numpy-doc Fixed in 1.17.3-6.module_el8.6.0+2778+cd494b30
- python38-numpy-f2py Fixed in 1.17.3-6.module_el8.6.0+2778+cd494b30
- python38-packaging Fixed in 19.2-3.module_el8.6.0+2778+cd494b30
- python38-pluggy Fixed in 0.13.0-3.module_el8.6.0+2778+cd494b30
- python38-ply Fixed in 3.11-10.module_el8.6.0+2778+cd494b30
- python38-psutil Fixed in 5.6.4-4.module_el8.6.0+2778+cd494b30
- python38-psycopg2 Fixed in 2.8.4-4.module_el8.6.0+2778+cd494b30
- python38-psycopg2-doc Fixed in 2.8.4-4.module_el8.6.0+2778+cd494b30
- python38-psycopg2-tests Fixed in 2.8.4-4.module_el8.6.0+2778+cd494b30
- python38-py Fixed in 1.8.0-8.module_el8.6.0+2778+cd494b30
- python38-pycparser Fixed in 2.19-3.module_el8.6.0+2778+cd494b30
- python38-pyparsing Fixed in 2.4.5-3.module_el8.6.0+2778+cd494b30
- python38-pysocks Fixed in 1.7.1-4.module_el8.6.0+2778+cd494b30
- python38-pytest Fixed in 4.6.6-3.module_el8.6.0+2778+cd494b30
- python38-pytz Fixed in 2019.3-3.module_el8.6.0+2778+cd494b30
- python38-pyyaml Fixed in 5.4.1-1.module_el8.6.0+2778+cd494b30
- python38-requests Fixed in 2.22.0-9.module_el8.6.0+2778+cd494b30
- python38-scipy Fixed in 1.3.1-4.module_el8.6.0+2778+cd494b30
- python38-setuptools Fixed in 41.6.0-5.module_el8.6.0+2778+cd494b30
42 further packages in CloudLinux 8 not shown (first 40 listed).
Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Debian 12
- pypy3 Fixed in 7.3.3+dfsg-4
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- pypy3 Fixed in 7.3.3+dfsg-4
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- pypy3 Fixed in 7.3.3+dfsg-4
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 18.04 LTS
- python3.6 Fixed in 3.6.9-1~18.04ubuntu1.7
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 20.04 LTS
- python3.9 Fixed in 3.9.5-3~20.04.1
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 14.04 LTS
- python3.4 Fixed in 3.4.3-1ubuntu1~14.04.7+esm12Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
- python3.5 Fixed in 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 16.04 LTS
- python3.5 Fixed in 3.5.2-2ubuntu0~16.04.13+esm2Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 18.04 LTS
- python3.7 Fixed in 3.7.5-2ubuntu1~18.04.2+esm1Available with Ubuntu Pro: https://ubuntu.com/pro
- python3.8 Fixed in 3.8.0-3ubuntu1~18.04.2+esm2Available with Ubuntu Pro: https://ubuntu.com/pro
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.