Summary
It was discovered that the urllib.request.AbstractBasicAuthHandler class
in Python contains regex with a quadratic worst-case time complexity.
Specially crafted traffic from a malicious HTTP server could cause a regular
expression denial of service (ReDoS) condition for a client.
(CVE-2021-3733)
It was discovered that the Python urllib http client could enter into an infinite
loop when incorrectly handling certain server responses (100 Continue response).
Specially crafted traffic from a malicious HTTP server could cause a denial of
service (DoS) condition for a client.
(CVE-2021-3737)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | python3.6 | 3.6.9-1~18.04ubuntu1.6 |
Vulnerabilities 2
-
High 7.5CVE-2021-3737 EPSS 13%
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote at…
-
Unscored —
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTT…