cbcvebase.
CVE-2020-8492
published 2020-01-30

CVE-2020-8492: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression…

PriorityP434medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
6.68%
93.1th percentile
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Affected

16 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debianpython2.7< python2.7 2.7.18-2 (bullseye)python2.7 2.7.18-2 (bullseye)
fedoraprojectfedora
fedoraprojectfedora
opensuseleap
pythonpython2.7.0 – 2.7.17
pythonpython3.5.0 – 3.5.9
pythonpython3.6.0 – 3.6.10
pythonpython3.7.0 – 3.7.6
pythonpython3.8.0 – 3.8.1

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
osv7.6HIGH
vendor_ubuntu7.6HIGH
vendor_debian6.5LOW
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.