CVE-2021-3733
published 2022-03-10CVE-2021-3733: There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
4.67%
90.7th percentile
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pypy3 | < pypy3 7.3.5+dfsg-2 (bookworm) | pypy3 7.3.5+dfsg-2 (bookworm) |
| debian | python2.7 | < pypy3 7.3.5+dfsg-2 (bookworm) | pypy3 7.3.5+dfsg-2 (bookworm) |
| debian | python3.9 | < pypy3 7.3.5+dfsg-2 (bookworm) | pypy3 7.3.5+dfsg-2 (bookworm) |
| fedoraproject | extra_packages_for_enterprise_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_python2_2.7.18-10_on_cbl_mariner_1.0 | — | — |
| python | python | < 3.6.14 | 3.6.14 |
| python | python | — | — |
| python | python | — | — |
| python | python | >= 3.7.0 < 3.7.11 | 3.7.11 |
| python | python | >= 3.8.0 < 3.8.10 | 3.8.10 |
| python | python | >= 3.9.0 < 3.9.5 | 3.9.5 |
| redhat | codeready_linux_builder | — | — |
| redhat | codeready_linux_builder_for_ibm_z_systems | — | — |
| redhat | codeready_linux_builder_for_power_little_endian | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_for_ibm_z_systems | — | — |
| redhat | enterprise_linux_for_ibm_z_systems_eus | — | — |
| redhat | enterprise_linux_for_power_little_endian | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
osv7.6HIGH
vendor_ubuntu7.6HIGH
vendor_debian6.5MEDIUM
vendor_msrc6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
osv·2024-07-11·CVSS 7.6
CVE-2015-20107 [HIGH] python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 L
GHSA
GHSA-wj55-vqcq-gxcp: There's a flaw in urllib's AbstractBasicAuthHandler class
ghsa_unreviewed·2022-03-11
CVE-2021-3733 [MEDIUM] CWE-400 GHSA-wj55-vqcq-gxcp: There's a flaw in urllib's AbstractBasicAuthHandler class
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
OSV
CVE-2021-3733: There's a flaw in urllib's AbstractBasicAuthHandler class
osv·2022-03-10·CVSS 6.5
CVE-2021-3733 [MEDIUM] CVE-2021-3733: There's a flaw in urllib's AbstractBasicAuthHandler class
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
OSV
python3.7, python3.8 vulnerabilities
osv·2021-12-17·CVSS 6.5
CVE-2020-8492 [MEDIUM] python3.7, python3.8 vulnerabilities
python3.7, python3.8 vulnerabilities
It was discovered that the urllib.request.AbstractBasicAuthHandler class
in Python contains regex allowing for catastrophic backtracking. Specially
crafted traffic from a malicious HTTP server could cause a regular expression
denial of service (ReDoS) condition for a client.
(CVE-2020-8492)
It was discovered that the urllib.request.AbstractBasicAuthHandler class
in Python contains regex with a quadratic worst-case time complexity.
Specially crafted traffic from a malicious HTTP server could cause a regular
expression denial of service (ReDoS) condition for a client.
(CVE-2021-3733)
It was discovered that the Python urllib http client could enter into an infinite
loop when incorrectly handling certain server responses (100 Continue response).
Speciall
OSV
python3.6 vulnerabilities
osv·2021-12-17·CVSS 6.5
CVE-2021-3733 [MEDIUM] python3.6 vulnerabilities
python3.6 vulnerabilities
It was discovered that the urllib.request.AbstractBasicAuthHandler class
in Python contains regex with a quadratic worst-case time complexity.
Specially crafted traffic from a malicious HTTP server could cause a regular
expression denial of service (ReDoS) condition for a client.
(CVE-2021-3733)
It was discovered that the Python urllib http client could enter into an infinite
loop when incorrectly handling certain server responses (100 Continue response).
Specially crafted traffic from a malicious HTTP server could cause a denial of
service (DoS) condition for a client.
(CVE-2021-3737)
OSV
python3.4, python3.5 vulnerabilities
osv·2021-09-16·CVSS 6.5
CVE-2021-3733 [MEDIUM] python3.4, python3.5 vulnerabilities
python3.4, python3.5 vulnerabilities
It was discovered that Python incorrectly handled certain RFCs.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 16.04 ESM. (CVE-2021-3733)
It was discovered that Python incorrectly handled certain
server responses. An attacker could possibly use this issue to
cause a denial of service. (CVE-2021-3737)
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-07-11·CVSS 7.6
CVE-2021-29921 [HIGH] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly handled certain inputs.
An attacker could possibly use this issue to execute arbitrary code.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 18.04 LTS.
(CVE-2015-20107)
It was discovered that Python incorrectly used regular expressions
vulnerable to catastrophic backtracking. A remote attacker could possibly
use this issue to cause a denial of service. This issue only affected
Ubuntu 14.04 LTS. (CVE-2018-1060, CVE-2018-1061)
It was discovered that Python failed to initialize Expat’s hash salt. A
remote attacker could possibly use this issue to cause hash collisions,
leading to a denial of service. This issue only affected Ubuntu 14.04 LTS.
(CVE-2018-14647)
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
cisa_ics·2023-12-14
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Release DateDecember 14, 2023
Alert CodeICSA-23-348-10
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
- Vulnerabilities: Improper Restriction of XML External Entity Reference, Time-of-check Time-of-use (TOCTOU) Race Condition, Command Injection, Miss
Microsoft
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to could trigger a Regular Expression Den
vendor_msrc·2022-03-08·CVSS 6.5
CVE-2021-3733 [MEDIUM] CWE-400 There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to could trigger a Regular Expression Den
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is co
Ubuntu
Python vulnerabilities
vendor_ubuntu·2021-12-17·CVSS 6.5
CVE-2021-3737 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Python could be made to crash if it receives specially crafted input from a malicious server.
It was discovered that the urllib.request.AbstractBasicAuthHandler class
in Python contains regex with a quadratic worst-case time complexity.
Specially crafted traffic from a malicious HTTP server could cause a regular
expression denial of service (ReDoS) condition for a client.
(CVE-2021-3733)
It was discovered that the Python urllib http client could enter into an infinite
loop when incorrectly handling certain server responses (100 Continue response).
Specially crafted traffic from a malicious HTTP server could cause a denial of
service (DoS) condition for a client.
(CVE-2021-3737)
Instructions: In general, a standard system update will make all the n
Ubuntu
Python vulnerabilities
vendor_ubuntu·2021-12-17·CVSS 6.5
CVE-2021-3737 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Python could be made to crash if it receives specially crafted input from a malicious server.
It was discovered that the urllib.request.AbstractBasicAuthHandler class
in Python contains regex allowing for catastrophic backtracking. Specially
crafted traffic from a malicious HTTP server could cause a regular expression
denial of service (ReDoS) condition for a client.
(CVE-2020-8492)
It was discovered that the urllib.request.AbstractBasicAuthHandler class
in Python contains regex with a quadratic worst-case time complexity.
Specially crafted traffic from a malicious HTTP server could cause a regular
expression denial of service (ReDoS) condition for a client.
(CVE-2021-3733)
It was discovered that the Python urllib http client could enter into an i
Ubuntu
Python vulnerabilities
vendor_ubuntu·2021-09-16·CVSS 6.5
CVE-2021-3733 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that Python incorrectly handled certain RFCs.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 16.04 ESM. (CVE-2021-3733)
It was discovered that Python incorrectly handled certain
server responses. An attacker could possibly use this issue to
cause a denial of service. (CVE-2021-3737)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python: urllib: Regular expression DoS in AbstractBasicAuthHandler
vendor_redhat·2021-08-10·CVSS 6.5
CVE-2021-3733 [MEDIUM] CWE-400 python: urllib: Regular expression DoS in AbstractBasicAuthHandler
python: urllib: Regular expression DoS in AbstractBasicAuthHandler
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the cl
Debian
CVE-2021-3733: pypy3 - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who contr...
vendor_debian·2021·CVSS 6.5
CVE-2021-3733 [MEDIUM] CVE-2021-3733: pypy3 - There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who contr...
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
Scope: local
bookworm: resolved (fixed in 7.3.5+dfsg-2)
bullseye: resolved (fixed in 7.3.5+dfsg-2)
forky: resolved (fixed in 7.3.5+dfsg-2)
sid: resolved (fixed in 7.3.5+dfsg-2)
trixie: resolved (fixed in 7.3.5+dfsg-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugs.python.org/issue43075https://bugzilla.redhat.com/show_bug.cgi?id=1995234https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fbhttps://github.com/python/cpython/pull/24391https://lists.debian.org/debian-lts-announce/2023/05/msg00024.htmlhttps://lists.debian.org/debian-lts-announce/2023/06/msg00039.htmlhttps://security.netapp.com/advisory/ntap-20220407-0001/https://ubuntu.com/security/CVE-2021-3733https://bugs.python.org/issue43075https://bugzilla.redhat.com/show_bug.cgi?id=1995234https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fbhttps://github.com/python/cpython/pull/24391https://lists.debian.org/debian-lts-announce/2023/05/msg00024.htmlhttps://lists.debian.org/debian-lts-announce/2023/06/msg00039.htmlhttps://lists.debian.org/debian-lts-announce/2024/12/msg00000.htmlhttps://security.netapp.com/advisory/ntap-20220407-0001/https://ubuntu.com/security/CVE-2021-3733
2022-03-10
Published