CVE-2021-3733
Publication date 2 September 2021
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
Status
Package | Ubuntu Release | Status |
---|---|---|
python3.10 | 24.04 LTS noble | Not in release |
22.04 LTS jammy |
Not affected
|
|
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored end of standard support | |
14.04 LTS trusty | Not in release | |
python3.4 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Not in release | |
14.04 LTS trusty |
Fixed 3.4.3-1ubuntu1~14.04.7+esm11
|
|
python3.5 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic | Not in release | |
16.04 LTS xenial |
Fixed 3.5.2-2ubuntu0~16.04.13+esm1
|
|
14.04 LTS trusty |
Fixed 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
|
|
python3.6 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Fixed 3.6.9-1~18.04ubuntu1.6
|
|
16.04 LTS xenial | Ignored end of standard support | |
14.04 LTS trusty | Not in release | |
python3.7 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Fixed 3.7.5-2ubuntu1~18.04.2
|
|
16.04 LTS xenial | Ignored end of standard support | |
14.04 LTS trusty | Not in release | |
python3.8 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal |
Fixed 3.8.10-0ubuntu1~20.04
|
|
18.04 LTS bionic |
Fixed 3.8.0-3ubuntu1~18.04.2
|
|
16.04 LTS xenial | Ignored end of standard support | |
14.04 LTS trusty | Not in release | |
python3.9 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal |
Fixed 3.9.5-3~20.04.1
|
|
18.04 LTS bionic | Not in release | |
16.04 LTS xenial | Ignored end of standard support | |
14.04 LTS trusty | Not in release |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProNotes
leosilva
code affected in hirsute and devel is already patched, so both releases in python3.9 are not affected.
Severity score breakdown
Parameter | Value |
---|---|
Base score | 6.5 · Medium |
Attack vector | Network |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | None |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-5083-1
- Python vulnerabilities
- 16 September 2021
- USN-5199-1
- Python vulnerabilities
- 17 December 2021
- USN-5200-1
- Python vulnerabilities
- 17 December 2021
- USN-6891-1
- Python vulnerabilities
- 11 July 2024
Other references
- https://bugs.python.org/issue43075
- https://github.com/python/cpython/pull/24391
- https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb1defe1 (master)
- https://github.com/python/cpython/commit/a21d4fbd549ec9685068a113660553d7f80d9b09 (3.9.5)
- https://github.com/python/cpython/commit/e7654b6046090914a8323931ed759a94a5f85d60 (3.8.10)
- https://github.com/python/cpython/commit/ada14995870abddc277addf57dd690a2af04c2da (3.7.11)
- https://github.com/python/cpython/commit/3fbe96123aeb66664fa547a8f6022efa2dc8788f (3.6.14)
- https://www.cve.org/CVERecord?id=CVE-2021-3733