Medium · published March 10, 2022
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
| Product | Versions | Fixed in |
|---|---|---|
| python/python | < 3.6.14 | 3.6.14 |
| python/python | ≥ 3.7.0, < 3.7.11 | 3.7.11 |
| python/python | ≥ 3.8.0, < 3.8.10 | 3.8.10 |
| python/python | ≥ 3.9.0, < 3.9.5 | 3.9.5 |
| python/python | all versions | — |
| redhat/codeready_linux_builder | all versions | — |
| redhat/codeready_linux_builder_for_ibm_z_systems | all versions | — |
| redhat/codeready_linux_builder_for_power_little_endian | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems_eus | all versions | — |
| redhat/enterprise_linux_for_power_little_endian | all versions | — |
| redhat/enterprise_linux_for_power_little_endian_eus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_update_services_for_sap_solutions | all versions | — |
| fedoraproject/extra_packages_for_enterprise_linux | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| netapp/management_services_for_element_software_and_netapp_hci | all versions | — |
| netapp/ontap_select_deploy_administration_utility | all versions | — |
| netapp/solidfire\,_enterprise_sds_\&_hci_storage_node | all versions | — |
| netapp/hci_compute_node_firmware | all versions | — |