Orta CVSS 6.5 PoC var
CVE-2021-3733: Python: denetimsiz kaynak tüketimi
Açıklama (NVD)
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
Özet bilgiler
- Ürün
- Python Python
- CVSS v3.1
- 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - EPSS
- %4,80 (yüzdelik 92)
- CWE
- CWE-400
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| python-python | — | — | 3.6.14 |
| python-python | 3.7.0 | — | 3.7.11 |
| python-python | 3.8.0 | — | 3.8.10 |
| python-python | 3.9.0 | — | 3.9.5 |
| python-python | 3.10.0 | 3.10.0 | — |
| redhat-codeready-linux-builder | 8.0 | 8.0 | — |
| redhat-codeready-linux-builder-for-ibm-z-systems | 8.0 | 8.0 | — |
| redhat-codeready-linux-builder-for-power-little-endian | 8.0 | 8.0 | — |
| redhat-enterprise-linux | 8.0 | 8.0 | — |
| redhat-enterprise-linux-eus | 8.4 | 8.4 | — |
| redhat-enterprise-linux-for-ibm-z-systems | 8.0 | 8.0 | — |
| redhat-enterprise-linux-for-ibm-z-systems-eus | 8.4 | 8.4 | — |
| redhat-enterprise-linux-for-power-little-endian | 8.0 | 8.0 | — |
| redhat-enterprise-linux-for-power-little-endian-eus | 8.4 | 8.4 | — |
| redhat-enterprise-linux-server-aus | 8.4 | 8.4 | — |
| redhat-enterprise-linux-server-for-power-little-endian-update-services-for-sap-solutions | 8.4 | 8.4 | — |
| redhat-enterprise-linux-server-tus | 8.4 | 8.4 | — |
| redhat-enterprise-linux-server-update-services-for-sap-solutions | 8.4 | 8.4 | — |
| fedoraproject-extra-packages-for-enterprise-linux | 7.0 | 7.0 | — |
| fedoraproject-fedora | 33 | 33 | — |
| fedoraproject-fedora | 34 | 34 | — |
| fedoraproject-fedora | 35 | 35 | — |
| fedoraproject-fedora | 36 | 36 | — |
| netapp-management-services-for-element-software-and-netapp-hci | — | — | — |
| netapp-ontap-select-deploy-administration-utility | — | — | — |
| netapp-solidfire-enterprise-sds-hci-storage-node | — | — | — |
| netapp-hci-compute-node-firmware | — | — | — |