CVE-2020-8492
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2020-8492
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8492.json
- Aliases
- Related
- Published
- 2020-01-30T19:15:12Z
- Modified
- 2023-12-06T01:00:40.960973Z
- Details
-
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
- References
-
- https://bugs.python.org/issue39503
- https://security.gentoo.org/glsa/202005-09
- https://security.netapp.com/advisory/ntap-20200221-0001/
- https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html
- https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html
- https://github.com/python/cpython/pull/18284
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html
- https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5%40%3Ccommits.cassandra.apache.org%3E
- https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/
- https://usn.ubuntu.com/4333-1/
- https://usn.ubuntu.com/4333-2/
Affected packages
Alpine:v3.10 / python3
Package
- Name
- python3
Alpine:v3.11 / python3
Package
- Name
- python3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0The exact introduced commit is unknownFixed3.8.2-r0
Affected versions
3.*
3.1.3-r0
3.2.0-r0
3.2.3-r0
3.3.0-r0
3.3.2-r0
3.3.3-r0
3.3.4-r0
3.4.1-r0
3.4.2-r0
3.4.2-r1
3.4.3-r1
3.4.3-r2
3.5.0-r0
3.5.1-r0
3.5.1-r1
3.5.1-r2
3.5.1-r3
3.5.2-r3
3.6.0-r3
3.6.1-r3
3.6.2-r3
3.6.3-r3
3.6.4-r3
3.6.6-r3
3.6.7-r3
3.6.8-r3
3.7.2-r3
3.7.3-r3
3.7.4-r3
3.7.5-r3
3.8.0-r3
3.8.1-r3
Alpine:v3.12 / python3
Package
- Name
- python3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0The exact introduced commit is unknownFixed3.8.2-r0
Affected versions
3.*
3.1.3-r0
3.2.0-r0
3.2.3-r0
3.3.0-r0
3.3.2-r0
3.3.3-r0
3.3.4-r0
3.4.1-r0
3.4.2-r0
3.4.2-r1
3.4.3-r1
3.4.3-r2
3.5.0-r0
3.5.1-r0
3.5.1-r1
3.5.1-r2
3.5.1-r3
3.5.2-r3
3.6.0-r3
3.6.1-r3
3.6.2-r3
3.6.3-r3
3.6.4-r3
3.6.6-r3
3.6.7-r3
3.6.8-r3
3.7.2-r3
3.7.3-r3
3.7.4-r3
3.7.5-r3
3.8.0-r3
3.8.1-r3
Alpine:v3.13 / python3
Package
- Name
- python3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0The exact introduced commit is unknownFixed3.8.2-r0
Affected versions
3.*
3.1.3-r0
3.2.0-r0
3.2.3-r0
3.3.0-r0
3.3.2-r0
3.3.3-r0
3.3.4-r0
3.4.1-r0
3.4.2-r0
3.4.2-r1
3.4.3-r1
3.4.3-r2
3.5.0-r0
3.5.1-r0
3.5.1-r1
3.5.1-r2
3.5.1-r3
3.5.2-r3
3.6.0-r3
3.6.1-r3
3.6.2-r3
3.6.3-r3
3.6.4-r3
3.6.6-r3
3.6.7-r3
3.6.8-r3
3.7.2-r3
3.7.3-r3
3.7.4-r3
3.7.5-r3
3.8.0-r3
3.8.1-r3
Alpine:v3.14 / python3
Package
- Name
- python3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0The exact introduced commit is unknownFixed3.8.2-r0
Affected versions
3.*
3.1.3-r0
3.2.0-r0
3.2.3-r0
3.3.0-r0
3.3.2-r0
3.3.3-r0
3.3.4-r0
3.4.1-r0
3.4.2-r0
3.4.2-r1
3.4.3-r1
3.4.3-r2
3.5.0-r0
3.5.1-r0
3.5.1-r1
3.5.1-r2
3.5.1-r3
3.5.2-r3
3.6.0-r3
3.6.1-r3
3.6.2-r3
3.6.3-r3
3.6.4-r3
3.6.6-r3
3.6.7-r3
3.6.8-r3
3.7.2-r3
3.7.3-r3
3.7.4-r3
3.7.5-r3
3.8.0-r3
3.8.1-r3
Alpine:v3.15 / python3
Package
- Name
- python3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0The exact introduced commit is unknownFixed3.8.2-r0
Affected versions
3.*
3.1.3-r0
3.2.0-r0
3.2.3-r0
3.3.0-r0
3.3.2-r0
3.3.3-r0
3.3.4-r0
3.4.1-r0
3.4.2-r0
3.4.2-r1
3.4.3-r1
3.4.3-r2
3.5.0-r0
3.5.1-r0
3.5.1-r1
3.5.1-r2
3.5.1-r3
3.5.2-r3
3.6.0-r3
3.6.1-r3
3.6.2-r3
3.6.3-r3
3.6.4-r3
3.6.6-r3
3.6.7-r3
3.6.8-r3
3.7.2-r3
3.7.3-r3
3.7.4-r3
3.7.5-r3
3.8.0-r3
3.8.1-r3
Alpine:v3.16 / python3
Package
- Name
- python3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0The exact introduced commit is unknownFixed3.8.2-r0
Affected versions
3.*
3.1.3-r0
3.2.0-r0
3.2.3-r0
3.3.0-r0
3.3.2-r0
3.3.3-r0
3.3.4-r0
3.4.1-r0
3.4.2-r0
3.4.2-r1
3.4.3-r1
3.4.3-r2
3.5.0-r0
3.5.1-r0
3.5.1-r1
3.5.1-r2
3.5.1-r3
3.5.2-r3
3.6.0-r3
3.6.1-r3
3.6.2-r3
3.6.3-r3
3.6.4-r3
3.6.6-r3
3.6.7-r3
3.6.8-r3
3.7.2-r3
3.7.3-r3
3.7.4-r3
3.7.5-r3
3.8.0-r3
3.8.1-r3
Alpine:v3.17 / python3
Package
- Name
- python3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0The exact introduced commit is unknownFixed3.8.2-r0
Affected versions
3.*
3.1.3-r0
3.2.0-r0
3.2.3-r0
3.3.0-r0
3.3.2-r0
3.3.3-r0
3.3.4-r0
3.4.1-r0
3.4.2-r0
3.4.2-r1
3.4.3-r1
3.4.3-r2
3.5.0-r0
3.5.1-r0
3.5.1-r1
3.5.1-r2
3.5.1-r3
3.5.2-r3
3.6.0-r3
3.6.1-r3
3.6.2-r3
3.6.3-r3
3.6.4-r3
3.6.6-r3
3.6.7-r3
3.6.8-r3
3.7.2-r3
3.7.3-r3
3.7.4-r3
3.7.5-r3
3.8.0-r3
3.8.1-r3
Alpine:v3.18 / python3
Package
- Name
- python3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0The exact introduced commit is unknownFixed3.8.2-r0
Affected versions
3.*
3.1.3-r0
3.2.0-r0
3.2.3-r0
3.3.0-r0
3.3.2-r0
3.3.3-r0
3.3.4-r0
3.4.1-r0
3.4.2-r0
3.4.2-r1
3.4.3-r1
3.4.3-r2
3.5.0-r0
3.5.1-r0
3.5.1-r1
3.5.1-r2
3.5.1-r3
3.5.2-r3
3.6.0-r3
3.6.1-r3
3.6.2-r3
3.6.3-r3
3.6.4-r3
3.6.6-r3
3.6.7-r3
3.6.8-r3
3.7.2-r3
3.7.3-r3
3.7.4-r3
3.7.5-r3
3.8.0-r3
3.8.1-r3