USN-5200-1

Source
https://ubuntu.com/security/notices/USN-5200-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/USN-5200-1.json
Related
Published
2021-12-17T14:59:29.220066Z
Modified
2021-12-17T14:59:29.220066Z
Details

It was discovered that the urllib.request.AbstractBasicAuthHandler class in Python contains regex allowing for catastrophic backtracking. Specially crafted traffic from a malicious HTTP server could cause a regular expression denial of service (ReDoS) condition for a client. (CVE-2020-8492)

It was discovered that the urllib.request.AbstractBasicAuthHandler class in Python contains regex with a quadratic worst-case time complexity. Specially crafted traffic from a malicious HTTP server could cause a regular expression denial of service (ReDoS) condition for a client. (CVE-2021-3733)

It was discovered that the Python urllib http client could enter into an infinite loop when incorrectly handling certain server responses (100 Continue response). Specially crafted traffic from a malicious HTTP server could cause a denial of service (DoS) condition for a client. (CVE-2021-3737)

References

Affected packages

Ubuntu:18.04:LTS / python3.8

Package

Name
python3.8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
3.8.0-3ubuntu1~18.04.2

Ecosystem specific 

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "python3.8-minimal": "3.8.0-3ubuntu1~18.04.2",
            "libpython3.8-testsuite": "3.8.0-3ubuntu1~18.04.2",
            "libpython3.8": "3.8.0-3ubuntu1~18.04.2",
            "libpython3.8-minimal": "3.8.0-3ubuntu1~18.04.2",
            "idle-python3.8": "3.8.0-3ubuntu1~18.04.2",
            "python3.8": "3.8.0-3ubuntu1~18.04.2",
            "python3.8-venv": "3.8.0-3ubuntu1~18.04.2",
            "python3.8-dev": "3.8.0-3ubuntu1~18.04.2",
            "python3.8-examples": "3.8.0-3ubuntu1~18.04.2",
            "libpython3.8-stdlib": "3.8.0-3ubuntu1~18.04.2",
            "libpython3.8-dev": "3.8.0-3ubuntu1~18.04.2"
        }
    ]
}