← לוח פגיעויות

CVE-2021-3733

בינונית 6.5

תיאור (מקור, אנגלית)

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

מדדים

CVSS 3.1
6.5 (MEDIUM) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS — סבירות ניצול
5% (אחוזון 100) נכון ל-19/10/2026
CWE
CWE-400

מוצרים מושפעים

python: python; redhat: codeready linux builder; redhat: codeready linux builder for ibm z systems; redhat: codeready linux builder for power little endian; redhat: enterprise linux; redhat: enterprise linux eus; redhat: enterprise linux for ibm z systems; redhat: enterprise linux for ibm z systems eus; redhat: enterprise linux for power little endian; redhat: enterprise linux for power little endian eus; redhat: enterprise linux server aus; redhat: enterprise linux server for power little endian update services for sap solutions; redhat: enterprise linux server tus; redhat: enterprise linux server update services for sap solutions; fedoraproject: extra packages for enterprise linux

קישורים