Medium · published January 31, 2020
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
| Product | Versions | Fixed in |
|---|---|---|
| python/python | ≥ 2.7.0, ≤ 2.7.17 | — |
| python/python | ≥ 3.5.0, ≤ 3.5.9 | — |
| python/python | ≥ 3.6.0, ≤ 3.6.10 | — |
| python/python | ≥ 3.7.0, ≤ 3.7.6 | — |
| python/python | ≥ 3.8.0, ≤ 3.8.1 | — |
| opensuse/leap | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| canonical/ubuntu_linux | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| debian/debian_linux | all versions | — |