Resource Exhaustion Affecting python39 package, versions <0:3.9.6-2.module+el8.5.0+20364+c7fe1181

Q: How to fix?

<p>Upgrade <code>Oracle:8</code> <code>python39</code> to version 0:3.9.6-2.module+el8.5.0+20364+c7fe1181 or higher.<br>This issue was patched in <code>ELSA-2021-4160</code>.</p>

Threat Intelligence

0.34% (72^nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-ORACLE8-PYTHON39-2588979
published 10 Apr 2022
disclosed 10 Mar 2022

Report a new vulnerability Found a mistake?

Introduced: 10 Mar 2022

CVE-2021-3733 Open this link in a new tab CWE-400 Open this link in a new tab

How to fix?

Upgrade Oracle:8 python39 to version 0:3.9.6-2.module+el8.5.0+20364+c7fe1181 or higher.
This issue was patched in ELSA-2021-4160.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python39 package and not the python39 package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

Low
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

None
Integrity (I)

None
Availability (A)

High

Resource Exhaustion Affecting python39 package, versions <0:3.9.6-2.module+el8.5.0+20364+c7fe1181

Severity

Based on Oracle Linux security rating