CVE-2021-3426: 
Python vulnerability analysis and mitigation

CVE-2021-3426 is a vulnerability discovered in Python 3's pydoc module. The vulnerability affects Python versions before 3.8.9, before 3.9.3, and before 3.10.0a7. When a local or adjacent attacker discovers or convinces another local or adjacent user to start a pydoc server, they could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access (NVD).

The vulnerability exists in the pydoc module's 'getfile' feature, which could be abused to read arbitrary files on the disk through directory traversal. The vulnerability has a CVSS v3.1 base score of 5.7 (MEDIUM) with the vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The issue affects both the -p and -n command options of pydoc (Red Hat Bugzilla).

The primary impact of this vulnerability is to data confidentiality. A successful exploit could allow attackers to access and read sensitive files belonging to users who have started a pydoc server. The highest risk is to data confidentiality, with no direct impact on system integrity or availability (NVD).

The vulnerability requires either local or adjacent network access. An attacker needs to either discover a running pydoc server or convince a user to start one. The /getfile?key=path URL can then be used to read arbitrary files on the filesystem through directory traversal (Red Hat Bugzilla).

The recommended mitigation is to upgrade to Python versions 3.8.9, 3.9.3, or 3.10.0a7 or later. As a workaround, users should avoid using the -p or -n options of pydoc and instead use the console output (no argument needed) or HTML file (-w argument) to generate documentation. The fix removes the 'getfile' feature of the pydoc module entirely (Red Hat Bugzilla).