Not rated
CVE-2021-3733 There's a flaw in urllib's AbstractBasicAuthHandler class
Description
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Python | Versions not published | |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
References
- bugs.python.org bugs.python.org
- bugzilla.redhat.com bugzilla.redhat.com
- github.com github.com
- ubuntu.com ubuntu.com
- github.com github.com
- security.netapp.com security.netapp.com
- [debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update lists.debian.org
- [debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of Python
The 7 CVEs of Python →
CVE-2020-10735
A flaw was found in python
6.2
Medium
CVE-2021-4189
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode
5.3
Medium
CVE-2021-3737
A flaw was found in python
7.5
High
CVE-2022-0391
A flaw was found in Python, specifically within the urllib.parse module
7.5
High