CVE-2021-28861High· 7.4▾ TwilightPython 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.5%
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
python >= 3.0.0, < 3.7.14python >= 3.8.0, < 3.8.14python >= 3.9.0, < 3.9.14python >= 3.10.0, < 3.10.6python = 3.11.0fedora = 35fedora = 36fedora = 37Upgrade past the affected range:
python 3.10.6Connected by shared product, vendor, weakness, or advisory.
CVE-2022-0391High· 7.5A flaw was found in Python, specifically within the urllib.parse module
CVE-2021-3737High· 7.5A flaw was found in python
CVE-2021-29921Critical· 9.8In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string
CVE-2015-20107High· 7.6In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file
CVE-2020-10735High· 7.5A flaw was found in python
CVE-2021-4189Medium· 5.3A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode