Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-3733

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a R

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a python

  • Fixed in python v3.6.14, python v3.7.11, python v3.8.10, python v3.9.5.affected

References