CVE-2021-3737

01/תיאור (מקור, אנגלית)

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

02/מוצרים מושפעים

python: python; redhat: codeready linux builder; redhat: codeready linux builder for ibm z systems; redhat: codeready linux builder for power little endian; redhat: enterprise linux; redhat: enterprise linux for ibm z systems; redhat: enterprise linux for power little endian; fedoraproject: fedora; canonical: ubuntu linux; netapp: hci; netapp: management services for element software; netapp: netapp xcp smb; netapp: ontap select deploy administration utility; netapp: xcp nfs; oracle: communications cloud native core binding support function

03/קישורים10

• bugs.python.org/issue44022 ExploitIssue TrackingVendor Advisory
• bugs.python.org/issue44022 ExploitIssue TrackingVendor Advisory
• bugzilla.redhat.com/show_bug.cgi?id=1995162 Issue TrackingPatchThird Party Advisory
• github.com/python/cpython/pull/25916 PatchThird Party Advisory
• github.com/python/cpython/pull/26503 PatchThird Party Advisory
• python-security.readthedocs.io/vuln/urllib-100-continue-loop.h‮… PatchThird Party Advisory
• ubuntu.com/security/CVE-2021-3737 PatchThird Party Advisory
• www.oracle.com/security-alerts/cpujul2022.html PatchThird Party Advisory
• bugzilla.redhat.com/show_bug.cgi?id=1995162 Issue TrackingPatchThird Party Advisory
• github.com/python/cpython/pull/25916 PatchThird Party Advisory