There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
Se presenta un fallo en la clase AbstractBasicAuthHandler de urllib. Un atacante que controle un servidor HTTP malicioso al que se conecte un cliente HTTP (como un navegador web), podría desencadenar una Denegación de Servicio por Expresión Regular (ReDOS) durante una petición de autenticación con una carga útil especialmente diseñada que sea enviada por el servidor al cliente. La mayor amenaza que supone este fallo es para la disponibilidad de la aplicación
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
AV:N/AC:L/Au:S/C:N/I:N/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | SINGLE |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-400
|
| [email protected] | Primary |
en
CWE-400
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| python | python | * | <built-in method update of dict object at 0x7fd36bacd340> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd36a656840> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd36b155480> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd36b1570c0> | Application |
| python | python | 3.10.0 | <built-in method update of dict object at 0x7fd36a654e40> | Application |
| redhat | codeready_linux_builder | 8.0 | <built-in method update of dict object at 0x7fd36a656b80> | Application |
| redhat | codeready_linux_builder_for_ibm_z_systems | 8.0 | <built-in method update of dict object at 0x7fd36b157bc0> | Application |
| redhat | codeready_linux_builder_for_power_little_endian | 8.0 | <built-in method update of dict object at 0x7fd3854bd240> | Application |
| redhat | enterprise_linux | 8.0 | <built-in method update of dict object at 0x7fd3854bf0c0> | Operating System |
| redhat | enterprise_linux_eus | 8.4 | <built-in method update of dict object at 0x7fd36bacef00> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems | 8.0 | <built-in method update of dict object at 0x7fd341be8240> | Operating System |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.4 | <built-in method update of dict object at 0x7fd36a657f80> | Operating System |
| redhat | enterprise_linux_for_power_little_endian | 8.0 | <built-in method update of dict object at 0x7fd36b1541c0> | Operating System |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.4 | <built-in method update of dict object at 0x7fd36b155840> | Operating System |
| redhat | enterprise_linux_server_aus | 8.4 | <built-in method update of dict object at 0x7fd3854bc8c0> | Operating System |
| redhat | enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | 8.4 | <built-in method update of dict object at 0x7fd341be8840> | Operating System |
| redhat | enterprise_linux_server_tus | 8.4 | <built-in method update of dict object at 0x7fd36a654300> | Operating System |
| redhat | enterprise_linux_server_update_services_for_sap_solutions | 8.4 | <built-in method update of dict object at 0x7fd36b155000> | Operating System |
| fedoraproject | extra_packages_for_enterprise_linux | 7.0 | <built-in method update of dict object at 0x7fd340be6780> | Application |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x7fd36b1555c0> | Operating System |
| fedoraproject | fedora | 34 | <built-in method update of dict object at 0x7fd36b156880> | Operating System |
| fedoraproject | fedora | 35 | <built-in method update of dict object at 0x7fd36a656180> | Operating System |
| fedoraproject | fedora | 36 | <built-in method update of dict object at 0x7fd36ada2180> | Operating System |
| netapp | management_services_for_element_software_and_netapp_hci | - | <built-in method update of dict object at 0x7fd36b155a40> | Application |
| netapp | ontap_select_deploy_administration_utility | - | <built-in method update of dict object at 0x7fd36b154bc0> | Application |
| netapp | solidfire\,_enterprise_sds_\&_hci_storage_node | - | <built-in method update of dict object at 0x7fd369d6c600> | Application |
| netapp | hci_compute_node_firmware | - | <built-in method update of dict object at 0x7fd36a655b80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:3.10.0:-:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:* |