IM
IronMonkey Threat Research

CVE-2020-8492 HIGH

Published: 2020-01-30 | Last Modified: 2026-10-07 | Status: Modified

Description

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Additional Descriptions (1)

Python versiones 2.7 hasta 2.7.17, versiones 3.5 hasta 3.5.9, versiones 3.6 hasta 3.6.10, versiones 3.7 hasta 3.7.6 y versiones 3.8 hasta 3.8.1, permiten a un servidor HTTP conducir ataques de Denegación de Servicio de Expresión Regular (ReDoS) contra un cliente debido a un backtracking catastrófico de la clase urllib.request.AbstractBasicAuthHandler.

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 3.6

Base Score: 7.1 (HIGH)

AV:N/AC:M/Au:N/C:N/I:N/A:C

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactCOMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 6.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-400
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-400

Affected Products

Vendor Product Version Update Type
python python * <built-in method update of dict object at 0x7fd2dbd9dac0> Application
python python * <built-in method update of dict object at 0x7fd3695da400> Application
python python * <built-in method update of dict object at 0x7fd3842b9340> Application
python python * <built-in method update of dict object at 0x7fd3695dbb00> Application
python python * <built-in method update of dict object at 0x7fd2dbd9dd00> Application
opensuse leap 15.1 <built-in method update of dict object at 0x7fd36b139800> Operating System
canonical ubuntu_linux 12.04 <built-in method update of dict object at 0x7fd3695dae80> Operating System
canonical ubuntu_linux 14.04 <built-in method update of dict object at 0x7fd36a002040> Operating System
canonical ubuntu_linux 16.04 <built-in method update of dict object at 0x7fd3695d9040> Operating System
canonical ubuntu_linux 18.04 <built-in method update of dict object at 0x7fd2dbd9c780> Operating System
canonical ubuntu_linux 19.10 <built-in method update of dict object at 0x7fd3695d84c0> Operating System
canonical ubuntu_linux 20.04 <built-in method update of dict object at 0x7fd3695d96c0> Operating System
fedoraproject fedora 31 <built-in method update of dict object at 0x7fd3842baa00> Operating System
fedoraproject fedora 32 <built-in method update of dict object at 0x7fd3842b8100> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd3842b9900> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:*:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

References