Skip to content
OpenAdvisories
Medium ALAS2-2021-1688 1 CVE

Moderate: python-urllib3 security update (Amazon Linux 2)

Published Jul 14, 2021 · Updated Jul 15, 2021

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-33503: A flaw was found in python-urllib3. When provided with a URL containing many @ characters in the authority component, the authority's regular expression exhibits catastrophic backtracking. This flaw causes a denial of service if a URL is passed as a parameter or redirected via an HTTP redirect. The highest threat from this vulnerability is to system availability. 1968074: CVE-2021-33503 python-urllib3: Catastrophic backtracking in URL authority parser

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 python-urllib3 0:1.25.9-1.amzn2.0.2

Vulnerabilities 1

  • High 7.5
    CVE-2021-33503

    Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

    An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a para…

    python-pip urllib3 python-urllib3 python-urllib3 Debian Ubuntu Azure Linux PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-33503.html