There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.
References
| Link | Resource |
|---|---|
| https://bugs.python.org/issue43075 | Exploit Issue Tracking Patch Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=1995234 | Issue Tracking Third Party Advisory |
| https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb | Patch Third Party Advisory |
| https://github.com/python/cpython/pull/24391 | Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html | |
| https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html | |
| https://security.netapp.com/advisory/ntap-20220407-0001/ | Third Party Advisory |
| https://ubuntu.com/security/CVE-2021-3733 | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
30 Jun 2023, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 May 2023, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
26 Oct 2022, 13:35
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems:8.0:*:*:*:*:*:*:* |
14 Jun 2022, 14:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fedoraproject:extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* |
01 Jun 2022, 20:30
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:python:python:3.9.0:-:*:*:*:*:*:* cpe:2.3:a:python:python:3.6.0:-:*:*:*:*:*:* cpe:2.3:a:python:python:3.8.0:-:*:*:*:*:*:* |
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* cpe:2.3:a:fedoraproject:fedora_extra_packages_for_enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:* cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian:8.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* cpe:2.3:a:python:python:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_server:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* cpe:2.3:a:redhat:codeready_linux_builder:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:* |
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20220407-0001/ - Third Party Advisory | |
| References | (MISC) https://ubuntu.com/security/CVE-2021-3733 - Patch, Third Party Advisory |
08 Apr 2022, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Mar 2022, 23:55
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-400 | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 6.5 |
| CPE | cpe:2.3:a:python:python:3.9.0:-:*:*:*:*:*:* cpe:2.3:a:python:python:3.6.0:-:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:python:python:3.7.0:-:*:*:*:*:*:* cpe:2.3:a:python:python:3.8.0:-:*:*:*:*:*:* cpe:2.3:a:python:python:3.10.0:-:*:*:*:*:*:* |
|
| References | (MISC) https://bugs.python.org/issue43075 - Exploit, Issue Tracking, Patch, Vendor Advisory | |
| References | (MISC) https://ubuntu.com/security/CVE-2021-3733 - Third Party Advisory | |
| References | (MISC) https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb - Patch, Third Party Advisory | |
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1995234 - Issue Tracking, Third Party Advisory | |
| References | (MISC) https://github.com/python/cpython/pull/24391 - Patch, Third Party Advisory |
10 Mar 2022, 17:54
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-10 17:42
Updated : 2024-02-04 22:29
NVD link : CVE-2021-3733
Mitre link : CVE-2021-3733
CVE.ORG link : CVE-2021-3733
JSON object : View
Products Affected
redhat
- enterprise_linux_for_power_little_endian_eus
- enterprise_linux
- enterprise_linux_eus
- codeready_linux_builder_for_power_little_endian
- enterprise_linux_for_power_little_endian
- enterprise_linux_for_ibm_z_systems_eus
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_server_update_services_for_sap_solutions
- codeready_linux_builder
- enterprise_linux_server_tus
- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
- codeready_linux_builder_for_ibm_z_systems
- enterprise_linux_server_aus
fedoraproject
- fedora
- extra_packages_for_enterprise_linux
netapp
- management_services_for_element_software_and_netapp_hci
- solidfire\,_enterprise_sds_\&_hci_storage_node
- hci_compute_node_firmware
- ontap_select_deploy_administration_utility
python
- python
CWE
CWE-400
Uncontrolled Resource Consumption