CVE-2021-3733

Description

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

CVSS breakdown

Affected products

• fedoraproject / extra_packages_for_enterprise_linux7.0 – 7.0
• fedoraproject / fedora33 – 33
• fedoraproject / fedora36 – 36
• fedoraproject / fedora35 – 35
• fedoraproject / fedora34 – 34
• NetApp / hci_compute_node_firmware
• NetApp / management_services_for_element_software_and_netapp_hci
• NetApp / ONTAP Select Deploy administration utility
• NetApp / solidfire,_enterprise_sds_&_hci_storage_node
• Python / python3.6.14
• Python / python3.10.0 – 3.10.0
• RedHat / codeready_linux_builder8.0 – 8.0
• RedHat / codeready_linux_builder_for_ibm_z_systems8.0 – 8.0
• RedHat / codeready_linux_builder_for_power_little_endian8.0 – 8.0
• RedHat / enterprise_linux8.0 – 8.0
• RedHat / enterprise_linux_eus8.4 – 8.4
• RedHat / enterprise_linux_for_ibm_z_systems8.0 – 8.0
• RedHat / enterprise_linux_for_ibm_z_systems_eus8.4 – 8.4
• RedHat / enterprise_linux_for_power_little_endian8.0 – 8.0
• RedHat / enterprise_linux_for_power_little_endian_eus8.4 – 8.4
• RedHat / enterprise_linux_server_aus8.4 – 8.4
• RedHat / enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.4 – 8.4
• RedHat / enterprise_linux_server_tus8.4 – 8.4
• RedHat / enterprise_linux_server_update_services_for_sap_solutions8.4 – 8.4

References

• MISChttps://bugs.python.org/issue43075
• MISChttps://bugzilla.redhat.com/show_bug.cgi?id=1995234
• PATCHhttps://github.com/python/cpython/pull/24391
• VENDOR_ADVISORYhttps://ubuntu.com/security/CVE-2021-3733
• PATCHhttps://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb
• MISChttps://security.netapp.com/advisory/ntap-20220407-0001/
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2023/06/msg00039.html