NetSight
IP …
medium6.5

CVE-2021-3733

There's a flaw in urllib's AbstractBasicAuthHandler class.

Impact

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Affected products

VendorProductAffected versions
PythonPython
before 3.6.14
from 3.7.0 before 3.7.11
from 3.8.0 before 3.8.10
from 3.9.0 before 3.9.5
Version 3.10.0
RedhatCodeready Linux Builder
Version 8.0
RedhatCodeready Linux Builder For Ibm Z Systems
Version 8.0
RedhatCodeready Linux Builder For Power Little Endian
Version 8.0
RedhatEnterprise Linux
Version 8.0
RedhatEnterprise Linux Eus
Version 8.4
RedhatEnterprise Linux For Ibm Z Systems
Version 8.0
RedhatEnterprise Linux For Ibm Z Systems Eus
Version 8.4
RedhatEnterprise Linux For Power Little Endian
Version 8.0
RedhatEnterprise Linux For Power Little Endian Eus
Version 8.4
RedhatEnterprise Linux Server Aus
Version 8.4
RedhatEnterprise Linux Server For Power Little Endian Update Services For Sap Solutions
Version 8.4

Weakness classification

CWE-400

References