CVE-2021-3737
גבוהה 7.5
תיאור (מקור, אנגלית)
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
מדדים
- CVSS 3.1
-
7.5 (HIGH)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS — סבירות ניצול
- 13% (אחוזון 100) נכון ל-19/10/2026
- CWE
- CWE-835, CWE-400
מוצרים מושפעים
python: python; redhat: codeready linux builder; redhat: codeready linux builder for ibm z systems; redhat: codeready linux builder for power little endian; redhat: enterprise linux; redhat: enterprise linux for ibm z systems; redhat: enterprise linux for power little endian; fedoraproject: fedora; canonical: ubuntu linux; netapp: hci; netapp: management services for element software; netapp: netapp xcp smb; netapp: ontap select deploy administration utility; netapp: xcp nfs; oracle: communications cloud native core binding support function
קישורים
- https://bugs.python.org/issue44022 ExploitIssue TrackingVendor Advisory
- https://bugs.python.org/issue44022 ExploitIssue TrackingVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1995162 Issue TrackingPatchThird Party Advisory
- https://github.com/python/cpython/pull/25916 PatchThird Party Advisory
- https://github.com/python/cpython/pull/26503 PatchThird Party Advisory
- https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html PatchThird Party Advisory
- https://ubuntu.com/security/CVE-2021-3737 PatchThird Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html PatchThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1995162 Issue TrackingPatchThird Party Advisory
- https://github.com/python/cpython/pull/25916 PatchThird Party Advisory