Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python38-asn1cryptoUpgrade python38-idnaUpgrade python38-pycparserUpgrade python38-psycopg2-testsUpgrade python38-pytzUpgrade python38-CythonUpgrade python38-cffiUpgrade python38-psycopg2-docUpgrade python38-psycopg2Upgrade python38-requestsUpgrade python38-markupsafeUpgrade python38-scipyUpgrade python38-chardetUpgrade python38-pysocksUpgrade python38-mod_wsgiUpgrade python38-cryptography | May 4, 2022 | Jan 30, 2020 |
| Alpine Linux | — | Upgrade python3 | Jan 4, 2021 | Jan 30, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pythonUpgrade python-toolsUpgrade python3Upgrade python38-libsUpgrade python3-testUpgrade tkinterUpgrade python3-toolsUpgrade python-testUpgrade python38Upgrade python38-testUpgrade python38-toolsUpgrade python3-tkinterUpgrade python38-debugUpgrade python38-tkinterUpgrade python3-libsUpgrade python38-debuginfoUpgrade python-debugUpgrade python3-develUpgrade python3-debuginfoUpgrade python-develUpgrade python-debuginfoUpgrade python-libsUpgrade python3-debugUpgrade python38-devel | Jun 4, 2020 | Jan 30, 2020 |
| Amazon_linux | — | Upgrade python34Upgrade python36Upgrade python35Upgrade python27Upgrade python26 | Jul 30, 2020 | Jan 30, 2020 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 30, 2020 |
| Centos_linux | — | Upgrade python38-psycopg2-testsUpgrade platform-pythonUpgrade python38-pycparserUpgrade python38-testUpgrade python-psutil-debugsourceUpgrade numpy-debugsourceUpgrade python38-asn1cryptoUpgrade python38-numpy-docUpgrade python38-setuptools-wheelUpgrade python38-debugUpgrade python38Upgrade python38-scipyUpgrade python38-psutilUpgrade python38-rpm-macrosUpgrade python38-Cython-debuginfoUpgrade python38-cryptography-debuginfoUpgrade python38-idnaUpgrade python38-pytzUpgrade python38-psutil-debuginfoUpgrade python38-sixUpgrade python38-numpy-f2pyUpgrade python-cffi-debugsourceUpgrade python38-cffiUpgrade python3-testUpgrade python38-debuginfoUpgrade python38-pipUpgrade python3-debugUpgrade python38-psycopg2-docUpgrade python38-markupsafe-debuginfoUpgrade python38-wheelUpgrade PyYAML-debugsourceUpgrade python-markupsafe-debugsourceUpgrade python38-PyMySQLUpgrade python38-markupsafeUpgrade python38-libsUpgrade python38-CythonUpgrade python3Upgrade python38-lxml-debuginfoUpgrade python38-numpyUpgrade python38-psycopg2Upgrade python38-numpy-debuginfoUpgrade python3-debuginfoUpgrade python38-babelUpgrade python38-pip-wheelUpgrade Cython-debugsourceUpgrade python38-wheel-wheelUpgrade python38-jinja2Upgrade python38-mod_wsgiUpgrade platform-python-debugUpgrade python-psycopg2-debugsourceUpgrade python38-urllib3Upgrade python3-develUpgrade python38-scipy-debuginfoUpgrade scipy-debugsourceUpgrade python38-pyyamlUpgrade python38-chardetUpgrade python38-idleUpgrade python38-tkinterUpgrade python38-lxmlUpgrade platform-python-develUpgrade python38-setuptoolsUpgrade python38-plyUpgrade python38-debugsourceUpgrade python3-idleUpgrade python3-libsUpgrade python-cryptography-debugsourceUpgrade python38-cryptographyUpgrade python38-pyyaml-debuginfoUpgrade python38-develUpgrade python-lxml-debugsourceUpgrade python38-psycopg2-debuginfoUpgrade python38-pysocksUpgrade python38-requestsUpgrade python3-debugsourceUpgrade python38-cffi-debuginfoUpgrade python3-tkinter | Oct 1, 2020 | Jan 30, 2020 |
| Debian | — | Upgrade python2.7 | Jul 16, 2020 | Jan 30, 2020 |
| Freebsd | — | Upgrade tauthonUpgrade python38Upgrade python35Upgrade python27Upgrade python37Upgrade python36 | Jun 4, 2021 | Sep 20, 2020 |
| Gentoo Linux | — | Upgrade dev-lang/python. | Jun 15, 2020 | Jan 30, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pythonUpgrade python-libsUpgrade python-develUpgrade tkinter | Jun 17, 2020 | Jan 30, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade python-libsUpgrade python-develUpgrade pythonUpgrade tkinter | Apr 16, 2020 | Jan 30, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade python-develUpgrade pythonUpgrade tkinterUpgrade python-libs | Mar 24, 2020 | Jan 30, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3Upgrade python3-testUpgrade python3-libsUpgrade python3-devel | Mar 24, 2020 | Jan 30, 2020 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle Solaris | — | Upgrade legacy/runtime/python-35 to version 3.5.9-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/python-37 to version 3.7.5-11.4.24.0.1.75.1 on Solaris 11.4Upgrade runtime/python-27 to version 2.7.18-11.4.24.0.1.75.1 on Solaris 11.4Upgrade legacy/runtime/python-34 to version 3.4.10-11.4.24.0.1.75.1 on Solaris 11.4 | Jan 19, 2021 | Jan 30, 2020 |
| Oracle_linux | — | Upgrade python38-psycopg2-docUpgrade python38-cffiUpgrade python38-pip-wheelUpgrade python38-develUpgrade python38-psycopg2Upgrade python38-libsUpgrade python38-numpy-f2pyUpgrade python38-pysocksUpgrade platform-pythonUpgrade python38-debugUpgrade python38-sixUpgrade python3-testUpgrade python38-wheelUpgrade python38-pycparserUpgrade python38-CythonUpgrade python38-markupsafeUpgrade python38-numpy-docUpgrade python38-pipUpgrade python38-psycopg2-testsUpgrade python38-testUpgrade python38-scipyUpgrade python38-idnaUpgrade python38-PyMySQLUpgrade python38-cryptographyUpgrade python38-wheel-wheelUpgrade python38-mod_wsgiUpgrade platform-python-develUpgrade python3Upgrade python38-chardetUpgrade python38-jinja2Upgrade python38-pyyamlUpgrade python38-pytzUpgrade python38-numpyUpgrade python38-rpm-macrosUpgrade python38-setuptoolsUpgrade python38-idleUpgrade python3-develUpgrade python38-plyUpgrade python38-tkinterUpgrade python38-asn1cryptoUpgrade platform-python-debugUpgrade python3-idleUpgrade python3-tkinterUpgrade python38-lxmlUpgrade python38-setuptools-wheelUpgrade python38-requestsUpgrade python38-psutilUpgrade python3-debugUpgrade python38-urllib3Upgrade python38-babelUpgrade python3-libsUpgrade python38 | Oct 7, 2020 | Mar 2, 2020 |
| Redhat_linux | — | Upgrade python38-numpy-debuginfoUpgrade python3-debugsourceUpgrade python-cryptography-debugsourceUpgrade python38-setuptoolsUpgrade python38-plyUpgrade python38-debugUpgrade python38-pipUpgrade python3-tkinterUpgrade python38-asn1cryptoUpgrade python-cffi-debugsourceUpgrade python38-psycopg2-debuginfoUpgrade python38-pyyaml-debuginfoUpgrade python3-debugUpgrade scipy-debugsourceUpgrade python38-Cython-debuginfoUpgrade python3-idleUpgrade python38-babelUpgrade python38-pyyamlUpgrade python3-develUpgrade python38-cffi-debuginfoUpgrade python38-jinja2Upgrade python38-CythonUpgrade python38-lxmlUpgrade Cython-debugsourceUpgrade python3-libsUpgrade python38-lxml-debuginfoUpgrade python3-debuginfoUpgrade python38-mod_wsgiUpgrade python38-sixUpgrade platform-python-develUpgrade PyYAML-debugsourceUpgrade python38-pytzUpgrade python38-markupsafeUpgrade python-psycopg2-debugsourceUpgrade python38-scipy-debuginfoUpgrade python38-debugsourceUpgrade python38-chardetUpgrade python38-pysocksUpgrade python38-scipyUpgrade platform-python-debugUpgrade python38-setuptools-wheelUpgrade python38-libsUpgrade python38-psutil-debuginfoUpgrade python-lxml-debugsourceNo solution existsUpgrade python38-cryptographyUpgrade python38-markupsafe-debuginfoUpgrade python38-PyMySQLUpgrade python38-rpm-macrosUpgrade python38-requestsUpgrade python-psutil-debugsourceUpgrade python38-numpy-f2pyUpgrade python3Upgrade numpy-debugsourceUpgrade python38-psutilUpgrade python38-develUpgrade python38-wheel-wheelUpgrade python38-idleUpgrade python38-psycopg2-testsUpgrade python38-debuginfoUpgrade python38-numpy-docUpgrade python38-numpyUpgrade python38-cryptography-debuginfoUpgrade python38-pycparserUpgrade python38-tkinterUpgrade python38-wheelUpgrade python38-pip-wheelUpgrade python38-psycopg2Upgrade python38Upgrade python38-idnaUpgrade python38-psycopg2-docUpgrade python3-testUpgrade python-markupsafe-debugsourceUpgrade python38-testUpgrade python38-cffiUpgrade platform-pythonUpgrade python38-urllib3 | Oct 1, 2020 | Jan 30, 2020 |
| Rocky_linux | — | Upgrade python38-numpy-f2pyUpgrade python38-Cython-debuginfoUpgrade python38-cffi-debuginfoUpgrade python-cryptography-debugsourceUpgrade python-markupsafe-debugsourceUpgrade Cython-debugsourceUpgrade numpy-debugsourceUpgrade python38-psycopg2Upgrade python38-pyyamlUpgrade python38-cryptography-debuginfoUpgrade python38-psycopg2-docUpgrade python38-markupsafe-debuginfoUpgrade python-psycopg2-debugsourceUpgrade python38-psutil-debuginfoUpgrade python38-pyyaml-debuginfoUpgrade python38-CythonUpgrade python38-numpyUpgrade PyYAML-debugsourceUpgrade python38-scipy-debuginfoUpgrade python38-psutilUpgrade python38-psycopg2-testsUpgrade python38-cffiUpgrade python38-markupsafeUpgrade python38-psycopg2-debuginfoUpgrade python38-cryptographyUpgrade python-psutil-debugsourceUpgrade scipy-debugsourceUpgrade python38-scipyUpgrade python38-numpy-debuginfoUpgrade python38-mod_wsgiUpgrade python-cffi-debugsource | Mar 12, 2024 | Jan 30, 2020 |
| Suse | — | Upgrade python3-docUpgrade libpython3_9-1_0Upgrade python-idleUpgrade libpython2_7-1_0-32bitUpgrade libpython2_6-1_0-32bitUpgrade python-xmlUpgrade python3-32bitUpgrade python3-dbmUpgrade pythonUpgrade python3Upgrade libpython3_4m1_0Upgrade python3-doc-devhelpUpgrade libpython3_6m1_0-32bitUpgrade python39-idleUpgrade libpython3_4m1_0-32bitUpgrade python-docUpgrade python3-baseUpgrade python-demoUpgrade python-baseUpgrade python-doc-pdfUpgrade python-base-32bitUpgrade python-tkUpgrade python39-dbmUpgrade libpython2_6-1_0Upgrade python36-baseUpgrade libpython2_7-1_0Upgrade libpython3_6m1_0Upgrade python-develUpgrade python3-testsuiteUpgrade python-cursesUpgrade python39-cursesUpgrade python3-toolsUpgrade python3-develUpgrade python-gdbmUpgrade python3-idleUpgrade python3-cursesUpgrade python-rpm-macrosUpgrade python3-tkUpgrade shared-python-startupUpgrade python39-develUpgrade python39Upgrade python39-toolsUpgrade python39-tkUpgrade python3-base-32bitUpgrade python36Upgrade python-32bitUpgrade python39-base | Mar 3, 2020 | Jan 30, 2020 |
| Ubuntu | — | Upgrade python3.6Upgrade python2.7-minimalUpgrade python3.6-minimalUpgrade python3.7Upgrade python3.7-minimalUpgrade python2.7Upgrade python3.5 (Ubuntu Pro)Upgrade python3.4 (Ubuntu Pro)Upgrade python3.5-minimal (Ubuntu Pro)Upgrade python2.7-minimal (Ubuntu Pro)Upgrade python3.5Upgrade libpython3.8-stdlibUpgrade python2.7 (Ubuntu Pro)Upgrade python3.8-minimalUpgrade python3.5-minimalUpgrade python3.8Upgrade python3.4-minimal (Ubuntu Pro)Upgrade libpython3.7-stdlib | Apr 22, 2020 | Jan 30, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 30, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub