Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python38-requestsUpgrade python38-mod_wsgiUpgrade python38-pysocksUpgrade python38-markupsafeUpgrade python38-psycopg2Upgrade python38-scipyUpgrade python38-cryptographyUpgrade python38-chardetUpgrade python38-pycparserUpgrade python38-idnaUpgrade python38-CythonUpgrade python38-asn1cryptoUpgrade python38-cffiUpgrade python38-pytzUpgrade python38-psycopg2-docUpgrade python38-psycopg2-tests | May 4, 2022 | Jan 30, 2020 |
| Alpine Linux | — | Upgrade python3 | Jan 4, 2021 | Jan 30, 2020 |
| Amazon Linux Ami 2 | — | Upgrade python38-develUpgrade python38-debuginfoUpgrade python3-debuginfoUpgrade python38-toolsUpgrade python-debuginfoUpgrade python3-tkinterUpgrade python3-develUpgrade python-develUpgrade python3-libsUpgrade python-libsUpgrade python38-tkinterUpgrade python-debugUpgrade python3-debugUpgrade python38-debugUpgrade python38-testUpgrade python3-toolsUpgrade python3-testUpgrade python38-libsUpgrade python38Upgrade pythonUpgrade tkinterUpgrade python-toolsUpgrade python-testUpgrade python3 | Jun 4, 2020 | Jan 30, 2020 |
| Amazon_linux | — | Upgrade python27Upgrade python35Upgrade python26Upgrade python36Upgrade python34 | Jul 30, 2020 | Jan 30, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 30, 2020 |
| Centos_linux | — | Upgrade python3Upgrade numpy-debugsourceUpgrade python38-numpy-f2pyUpgrade python-psutil-debugsourceUpgrade python38-asn1cryptoUpgrade python38-PyMySQLUpgrade python38-psutilUpgrade python38-sixUpgrade python38-Cython-debuginfoUpgrade python38-setuptools-wheelUpgrade python38-lxml-debuginfoUpgrade platform-pythonUpgrade python38-cryptography-debuginfoUpgrade python38-psycopg2Upgrade python38-psycopg2-testsUpgrade python38-pytzUpgrade python38-pycparserUpgrade python38-CythonUpgrade python38-idnaUpgrade python38-numpyUpgrade python38-numpy-debuginfoUpgrade python38-psutil-debuginfoUpgrade python38-scipyUpgrade python38-testUpgrade python38-markupsafeUpgrade python38-pipUpgrade python-markupsafe-debugsourceUpgrade python3-debugUpgrade python38-wheelUpgrade PyYAML-debugsourceUpgrade python38-rpm-macrosUpgrade python3-testUpgrade python38-debuginfoUpgrade python38-psycopg2-docUpgrade python38-cffiUpgrade python38-markupsafe-debuginfoUpgrade python38-debugUpgrade python38-libsUpgrade python38-numpy-docUpgrade python-cffi-debugsourceUpgrade python38Upgrade python3-idleUpgrade python38-urllib3Upgrade python38-lxmlUpgrade platform-python-develUpgrade python38-setuptoolsUpgrade python38-plyUpgrade python38-pip-wheelUpgrade python38-debugsourceUpgrade Cython-debugsourceUpgrade python38-cffi-debuginfoUpgrade python38-pyyaml-debuginfoUpgrade python3-libsUpgrade python38-develUpgrade scipy-debugsourceUpgrade python38-pyyamlUpgrade python-psycopg2-debugsourceUpgrade python38-scipy-debuginfoUpgrade platform-python-debugUpgrade python38-cryptographyUpgrade python38-psycopg2-debuginfoUpgrade python3-debugsourceUpgrade python38-pysocksUpgrade python38-requestsUpgrade python3-develUpgrade python38-chardetUpgrade python3-tkinterUpgrade python-cryptography-debugsourceUpgrade python38-mod_wsgiUpgrade python38-jinja2Upgrade python38-idleUpgrade python38-babelUpgrade python-lxml-debugsourceUpgrade python3-debuginfoUpgrade python38-wheel-wheelUpgrade python38-tkinter | Oct 1, 2020 | Jan 30, 2020 |
| Debian | — | Upgrade python2.7 | Jul 16, 2020 | Jan 30, 2020 |
| Freebsd | — | Upgrade python36Upgrade python38Upgrade python37Upgrade python35Upgrade tauthonUpgrade python27 | Jun 4, 2021 | Sep 20, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/python. | Jun 15, 2020 | Jan 30, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade python-develUpgrade tkinterUpgrade python-libsUpgrade python | Jun 17, 2020 | Jan 30, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-libsUpgrade python-develUpgrade pythonUpgrade tkinter | Apr 16, 2020 | Jan 30, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade tkinterUpgrade python-develUpgrade pythonUpgrade python-libs | Mar 24, 2020 | Jan 30, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3Upgrade python3-testUpgrade python3-libsUpgrade python3-devel | Mar 24, 2020 | Jan 30, 2020 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle Solaris | — | Upgrade legacy/runtime/python-34 to version 3.4.10-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.18-11.4.24.0.1.75.1 on Solaris 11.4Upgrade legacy/runtime/python-35 to version 3.5.9-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/python-37 to version 3.7.5-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Jan 30, 2020 |
| Oracle_linux | — | Upgrade python38-wheelUpgrade python38-debugUpgrade python38-psycopg2-docUpgrade python38-markupsafeUpgrade python38-develUpgrade python3-testUpgrade python38-numpy-f2pyUpgrade python38-cffiUpgrade python38-psycopg2Upgrade python38-libsUpgrade python38-sixUpgrade python38-pysocksUpgrade platform-pythonUpgrade python38-pycparserUpgrade python38-CythonUpgrade python38-PyMySQLUpgrade python38-psycopg2-testsUpgrade python38-testUpgrade python38-scipyUpgrade python38-idnaUpgrade python38-numpy-docUpgrade python38-pip-wheelUpgrade python38-pipUpgrade python38-numpyUpgrade python38-rpm-macrosUpgrade python3-tkinterUpgrade python38-wheel-wheelUpgrade python38-pytzUpgrade python38-pyyamlUpgrade python38-setuptoolsUpgrade python38Upgrade python38-requestsUpgrade python38-asn1cryptoUpgrade python38-chardetUpgrade python38-tkinterUpgrade python38-setuptools-wheelUpgrade python38-psutilUpgrade platform-python-debugUpgrade python3-idleUpgrade python38-babelUpgrade python38-urllib3Upgrade python3-libsUpgrade platform-python-develUpgrade python3-develUpgrade python38-cryptographyUpgrade python3-debugUpgrade python38-mod_wsgiUpgrade python38-jinja2Upgrade python3Upgrade python38-plyUpgrade python38-idleUpgrade python38-lxml | Oct 7, 2020 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade python38-wheel-wheelUpgrade python38-psutil-debuginfoUpgrade python38-psutilUpgrade python38-tkinterUpgrade python38-debuginfoUpgrade python38-cryptography-debuginfoUpgrade python38-numpy-docUpgrade python-lxml-debugsourceUpgrade python3Upgrade python38-urllib3Upgrade numpy-debugsourceUpgrade python38Upgrade python38-pip-wheelUpgrade python38-idnaUpgrade python38-PyMySQLUpgrade python38-psycopg2-docUpgrade python3-testUpgrade python-psutil-debugsourceUpgrade python-markupsafe-debugsourceUpgrade python38-idleUpgrade python38-pycparserUpgrade python38-libsUpgrade python38-cffiUpgrade python38-markupsafe-debuginfoUpgrade python38-psycopg2-testsUpgrade python38-setuptools-wheelUpgrade python38-rpm-macrosUpgrade python38-requestsUpgrade python38-numpy-f2pyUpgrade python38-psycopg2Upgrade python38-wheelNo solution existsUpgrade python38-numpyUpgrade platform-pythonUpgrade python38-develUpgrade python38-testUpgrade python38-cryptographyUpgrade python38-markupsafeUpgrade python38-sixUpgrade python38-chardetUpgrade python38-mod_wsgiUpgrade python3-develUpgrade python3-tkinterUpgrade Cython-debugsourceUpgrade python38-CythonUpgrade platform-python-debugUpgrade python38-psycopg2-debuginfoUpgrade python38-numpy-debuginfoUpgrade python38-pyyamlUpgrade python3-debugsourceUpgrade python-cryptography-debugsourceUpgrade python38-asn1cryptoUpgrade python-cffi-debugsourceUpgrade python3-libsUpgrade python3-idleUpgrade python3-debuginfoUpgrade python38-lxml-debuginfoUpgrade python38-Cython-debuginfoUpgrade python38-pipUpgrade python-psycopg2-debugsourceUpgrade python38-debugsourceUpgrade platform-python-develUpgrade python38-pytzUpgrade python38-babelUpgrade PyYAML-debugsourceUpgrade python38-debugUpgrade python38-pyyaml-debuginfoUpgrade python38-setuptoolsUpgrade python3-debugUpgrade scipy-debugsourceUpgrade python38-pysocksUpgrade python38-jinja2Upgrade python38-cffi-debuginfoUpgrade python38-plyUpgrade python38-scipyUpgrade python38-scipy-debuginfoUpgrade python38-lxml | Oct 1, 2020 | Jan 30, 2020 |
| Rocky_linux | — | Upgrade python38-scipyUpgrade python38-CythonUpgrade python-cffi-debugsourceUpgrade python38-numpy-debuginfoUpgrade python38-mod_wsgiUpgrade PyYAML-debugsourceUpgrade python38-cffiUpgrade python38-numpyUpgrade python38-cryptographyUpgrade python38-psycopg2-debuginfoUpgrade python-psutil-debugsourceUpgrade scipy-debugsourceUpgrade python38-pyyaml-debuginfoUpgrade python38-markupsafeUpgrade python38-psycopg2-testsUpgrade python38-psutilUpgrade python38-scipy-debuginfoUpgrade python38-pyyamlUpgrade python38-psycopg2-docUpgrade python-markupsafe-debugsourceUpgrade python38-markupsafe-debuginfoUpgrade numpy-debugsourceUpgrade python-cryptography-debugsourceUpgrade python38-cffi-debuginfoUpgrade python38-psutil-debuginfoUpgrade python-psycopg2-debugsourceUpgrade python38-numpy-f2pyUpgrade python38-Cython-debuginfoUpgrade Cython-debugsourceUpgrade python38-psycopg2Upgrade python38-cryptography-debuginfo | Mar 12, 2024 | Jan 30, 2020 |
| Suse | — | Upgrade python-base-32bitUpgrade python3-develUpgrade python39-develUpgrade python-cursesUpgrade python3-cursesUpgrade python-rpm-macrosUpgrade python-doc-pdfUpgrade python-develUpgrade python39-cursesUpgrade libpython3_6m1_0Upgrade python-32bitUpgrade python3-testsuiteUpgrade python3-idleUpgrade libpython2_7-1_0Upgrade python39Upgrade shared-python-startupUpgrade python39-toolsUpgrade python3-tkUpgrade python-gdbmUpgrade python-tkUpgrade python36-baseUpgrade python3-toolsUpgrade python39-tkUpgrade python39-baseUpgrade python36Upgrade python39-dbmUpgrade libpython2_6-1_0Upgrade python3-base-32bitUpgrade python39-idleUpgrade python3-baseUpgrade python-docUpgrade python-idleUpgrade libpython3_4m1_0-32bitUpgrade libpython2_7-1_0-32bitUpgrade python3-32bitUpgrade libpython3_6m1_0-32bitUpgrade python-baseUpgrade python3Upgrade libpython3_4m1_0Upgrade pythonUpgrade python-demoUpgrade python3-docUpgrade libpython2_6-1_0-32bitUpgrade python3-dbmUpgrade libpython3_9-1_0Upgrade python3-doc-devhelpUpgrade python-xml | Mar 3, 2020 | Jan 30, 2020 |
| Ubuntu | — | Upgrade python2.7Upgrade python3.6Upgrade python3.5 (Ubuntu Pro)Upgrade python2.7-minimalUpgrade python3.7-minimalUpgrade python3.6-minimalUpgrade python3.7Upgrade python3.4 (Ubuntu Pro)Upgrade python3.5-minimal (Ubuntu Pro)Upgrade libpython3.7-stdlibUpgrade python3.4-minimal (Ubuntu Pro)Upgrade python3.8-minimalUpgrade libpython3.8-stdlibUpgrade python3.5Upgrade python3.5-minimalUpgrade python3.8Upgrade python2.7-minimal (Ubuntu Pro)Upgrade python2.7 (Ubuntu Pro) | Apr 22, 2020 | Jan 30, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 30, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub