CVE-2021-3737High· 7.5▾ TwilightA flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highes…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 2.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
12%
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
python >= 3.6.0, < 3.6.14python >= 3.7.0, < 3.7.11python >= 3.8.0, < 3.8.11python >= 3.9.0, < 3.9.6codeready_linux_builder = 8.0codeready_linux_builder_for_ibm_z_systems = 8.0codeready_linux_builder_for_power_little_endian = 8.0enterprise_linux = 6.0enterprise_linux = 7.0enterprise_linux = 8.0enterprise_linux_for_ibm_z_systems = 8.0enterprise_linux_for_power_little_endian = 8.0fedora = 33fedora = 34ubuntu_linux = 14.04ubuntu_linux = 16.04ubuntu_linux = 18.04ubuntu_linux = 20.04ubuntu_linux = 21.04hcimanagement_services_for_element_softwarenetapp_xcp_smbontap_select_deploy_administration_utilityxcp_nfscommunications_cloud_native_core_binding_support_function = 22.1.3communications_cloud_native_core_network_exposure_function = 22.1.1communications_cloud_native_core_policy = 22.2.0Upgrade past the affected range:
python 3.9.6Connected by shared product, vendor, weakness, or advisory.
CVE-2021-3733Medium· 6.5There's a flaw in urllib's AbstractBasicAuthHandler class
CVE-2020-8492Medium· 6.5Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.A…
CVE-2019-20907High· 7.5In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.
CVE-2021-28861High· 7.4Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure
CVE-2021-4189Medium· 5.3A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode
CVE-2021-3426Medium· 5.7There's a flaw in Python 3's pydoc