CVE - CVE-2021-3733

CVE-ID
CVE-2021-3733	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://security.netapp.com/advisory/ntap-20220407-0001/ MISC:https://bugs.python.org/issue43075 URL:https://bugs.python.org/issue43075 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=1995234 URL:https://bugzilla.redhat.com/show_bug.cgi?id=1995234 MISC:https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb URL:https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb MISC:https://github.com/python/cpython/pull/24391 URL:https://github.com/python/cpython/pull/24391 MISC:https://ubuntu.com/security/CVE-2021-3733 URL:https://ubuntu.com/security/CVE-2021-3733 MLIST:[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update URL:https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html MLIST:[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update URL:https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
Assigning CNA
Red Hat, Inc.
Date Record Created
20210823	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20210823)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)