NetSight
IP …
medium6.5

CVE-2020-8492

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression …

Impact

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Affected products

VendorProductAffected versions
PythonPython
from 2.7.0 through 2.7.17
from 3.5.0 through 3.5.9
from 3.6.0 through 3.6.10
from 3.7.0 through 3.7.6
from 3.8.0 through 3.8.1
OpensuseLeap
Version 15.1
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 18.04, 19.10, 20.04
FedoraprojectFedora
Versions 31, 32
DebianDebian Linux
Version 9.0

Weakness classification

CWE-400

References