CVE-2021-3733

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.(CVE-2021-3737)

There s a flaw in urllib s AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.(CVE-2021-3733)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Information disclosure via pydoc (CVE-2021-3426)

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

• python-ipaddress: Improper input validation of octal strings (CVE-2021-29921)

• python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

• python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python38 (3.8), python38-devel (3.8). (BZ#1997680, BZ#1997860)

Security Fix(es):

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

• python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

Security Fix(es):

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python: ftplib should not use the host from the PASV response (CVE-2021-4189)

• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

• python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Information disclosure via pydoc (CVE-2021-3426)

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

• python-ipaddress: Improper input validation of octal strings (CVE-2021-29921)

• python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

• python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python38 (3.8), python38-devel (3.8). (BZ#1997680, BZ#1997860)

Security Fix(es):

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

• python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

Security Fix(es):

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python: ftplib should not use the host from the PASV response (CVE-2021-4189)

• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

• python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

• SECURITY UPDATE: Denial of service
  • debian/patches/CVE-2021-3737-*.patch: Fix http client infinite line reading (DoS) after a HTTP 100 continue in Lib/http/client.py, Lib/test/test_httplib.py.
  • CVE-2021-3737
• SECURITY UPDATE: Denial of service
  • debian/patches/CVE-2021-3733.patch: fix a ReDoS in urllib AbstractBasicAuthHandler in Lib/urllib/request.py.
  • CVE-2021-3733

• CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler (rhbz#2047376)
• CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response (rhbz#2047376)
• CVE-2021-4189: ftplib should not use the host from the PASV response (rhbz#2047376)
• CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs (rhbz#2047376)

• CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler (rhbz#2047376)
• CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response (rhbz#2047376)
• CVE-2021-4189: ftplib should not use the host from the PASV response (rhbz#2047376)
• CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs (rhbz#2047376)

• SECURITY UPDATE: Regular Expression Denial of Service
  • debian/patches/CVE-2021-3733.patch: Fix ReDoS vulnerability in AbstractBasicAuthHandler class of Lib/urllib2.py
  • CVE-2021-3733

• SECURITY UPDATE: Regular Expression Denial of Service
  • debian/patches/CVE-2021-3733.patch: Fix ReDoS vulnerability in AbstractBasicAuthHandler class of Lib/urllib2.py
  • CVE-2021-3733

• CVE-2021-3733: fix ReDoS in urllib2 AbstractBasicAuthHandler regex; the legacy '(?:.,)' prefix is replaced with the upstream-3.x form '(?:^|,)' and the scheme charset excludes ',' to prevent quadratic backtracking on crafted WWW-Authenticate headers
• CVE-2021-23336: stop accepting ';' as a default query-string separator in urlparse.parse_qs/parse_qsl and cgi.parse* / FieldStorage; only '&' is used by default, with an opt-in 'separator' kwarg for callers that need legacy behavior
• Additional tests for CVE-2021-23336: drop obsolete legacy-';' entries from Lib/test/test_cgi.py parse_strict_test_cases

• CVE-2021-3733: fix ReDoS in urllib2 AbstractBasicAuthHandler regex; the legacy '(?:.,)' prefix is replaced with the upstream-3.x form '(?:^|,)' and the scheme charset excludes ',' to prevent quadratic backtracking on crafted WWW-Authenticate headers
• CVE-2021-23336: stop accepting ';' as a default query-string separator in urlparse.parse_qs/parse_qsl and cgi.parse* / FieldStorage; only '&' is used by default, with an opt-in 'separator' kwarg for callers that need legacy behavior
• Additional tests for CVE-2021-23336: drop obsolete legacy-';' entries from Lib/test/test_cgi.py parse_strict_test_cases

bpo-42278: Replaced usage of tempfile.mktemp() with TemporaryDirectory to avoid a potential race condition.

bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the fix for the CVE-2013-0340 “Billion Laughs” vulnerability. This copy is most used on Windows and macOS.

bpo-43124: Made the internal putcmd function in smtplib sanitize input for presence of \r and \n characters to avoid (unlikely) command injection.

bpo-36384: ipaddress module no longer accepts any leading zeros in IPv4 address strings. Leading zeros are ambiguous and interpreted as octal notation by some libraries. For example the legacy function socket.inet_aton() treats leading zeros as octal notation. glibc implementation of modern inet_pton() does not accept any leading zeros. For a while the ipaddress module used to accept ambiguous leading zeros.

It was discovered that Python incorrectly handled certain RFCs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM. (CVE-2021-3733)

It was discovered that Python incorrectly handled certain server responses. An attacker could possibly use this issue to cause a denial of service. (CVE-2021-3737)

Denial of service when identifying crafted invalid RFCs Security fix for CVE-2021-3737: python client can enter an infinite loop on a 100 Continue response from the server

This update for python fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)
• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)
• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

This update for python3 fixes the following issues:

• CVE-2021-3426: Fixed information disclosure via pydoc (bsc#1183374).

• CVE-2021-3733: Fixed infinitely reading potential HTTP headers after a 100 Continue status response from the server (bsc#1189241).

• CVE-2021-3737: Fixed ReDoS in urllib.request (bsc#1189287).

• We do not require python-rpm-macros package (bsc#1180125).

• Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858).

• Stop providing 'python' symbol, which means python2 currently (bsc#1185588).

• Modify Lib/ensurepip/init.py to contain the same version numbers as are in reality the ones in the bundled wheels (bsc#1187668).

These are all security issues fixed in the python-2.7.18-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.7-2.1 package on the GA media of openSUSE Tumbleweed.

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

This update for python3 fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)
• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

This update for python36 fixes the following issues:

• Update to 3.6.15:
• CVE-2021-3737: Fixed a DoS caused by infinitely reading potential HTTP headers after a 100 Continue status response from the server. (bsc#1189241)
• CVE-2021-3426: Fixed an information disclosure via pydoc. (bsc#1183374)
• CVE-2021-3733: Fixed a ReDoS in urllib.request. (bsc#1189287)

This update for python fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)
• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

This update for python fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)
• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

This update for python3 fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)

• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

• CVE-2021-3426: Fixed an information disclosure via pydoc. (bsc#1183374)

• Rebuild to get new headers, avoid building in support for stropts.h (bsc#1187338).

This update for python3 fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)

• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

• CVE-2021-3426: Fixed an information disclosure via pydoc. (bsc#1183374)

• Rebuild to get new headers, avoid building in support for stropts.h (bsc#1187338).

This update for python3 fixes the following issues:

• CVE-2021-3426: Fixed information disclosure via pydoc (bsc#1183374).

• CVE-2021-3733: Fixed infinitely reading potential HTTP headers after a 100 Continue status response from the server (bsc#1189241).

• CVE-2021-3737: Fixed ReDoS in urllib.request (bsc#1189287).

• We do not require python-rpm-macros package (bsc#1180125).

• Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858).

• Stop providing 'python' symbol, which means python2 currently (bsc#1185588).

• Modify Lib/ensurepip/init.py to contain the same version numbers as are in reality the ones in the bundled wheels (bsc#1187668).

This update for python39 fixes the following issues:

• CVE-2021-3572: Fixed an improper handling of unicode characters in pip (bsc#1186819).

• Update to 3.9.10 (jsc#SLE-23849)

• Remove shebangs from from python-base libraries in _libdir. (bsc#1193179)

• Update to 3.9.9:

  • Core and Builtins
    • bpo-30570: Fixed a crash in issubclass() from infinite recursion when searching pathological bases tuples.
    • bpo-45494: Fix parser crash when reporting errors involving invalid continuation characters. Patch by Pablo Galindo.
    • bpo-45385: Fix reference leak from descr_check. Patch by Dong-hee Na.
    • bpo-45167: Fix deepcopying of types.GenericAlias objects.
    • bpo-44219: Release the GIL while performing isatty system calls on arbitrary file descriptors. In particular, this affects os.isatty(), os.device_encoding() and io.TextIOWrapper. By extension, io.open() in text mode is also affected. This change solves a deadlock in os.isatty(). Patch by Vincent Michel in bpo-44219.
    • bpo-44959: Added fallback to extension modules with '.sl' suffix on HP-UX
    • bpo-44050: Extensions that indicate they use global state (by setting m_size to -1) can again be used in multiple interpreters. This reverts to behavior of Python 3.8.
    • bpo-45121: Fix issue where Protocol.init raises RecursionError when it's called directly or via super(). Patch provided by Yurii Karabas.
    • bpo-45083: When the interpreter renders an exception, its name now has a complete qualname. Previously only the class name was concatenated to the module name, which sometimes resulted in an incorrect full name being displayed.
    • bpo-45738: Fix computation of error location for invalid continuation characters in the parser. Patch by Pablo Galindo.
    • Library
    • bpo-45678: Fix bug in Python 3.9 that meant functools.singledispatchmethod failed to properly wrap the attributes of the target method. Patch by Alex Waygood.
    • bpo-45679: Fix caching of multi-value typing.Literal. Literal[True, 2] is no longer equal to Literal[1, 2].
    • bpo-45438: Fix typing.Signature string representation for generic builtin types.
    • bpo-45581: sqlite3.connect() now correctly raises MemoryError if the underlying SQLite API signals memory error. Patch by Erlend E. Aasland.
    • bpo-39679: Fix bug in functools.singledispatchmethod that caused it to fail when attempting to register a classmethod() or staticmethod() using type annotations. Patch contributed by Alex Waygood.
    • bpo-45515: Add references to zoneinfo in the datetime documentation, mostly replacing outdated references to dateutil.tz. Change by Paul Ganssle.
    • bpo-45467: Fix incremental decoder and stream reader in the 'raw-unicode-escape' codec. Previously they failed if the escape sequence was split.
    • bpo-45461: Fix incremental decoder and stream reader in the 'unicode-escape' codec. Previously they failed if the escape sequence was split.
    • bpo-45239: Fixed email.utils.parsedate_tz() crashing with UnboundLocalError on certain invalid input instead of returning None. Patch by Ben Hoyt.
    • bpo-44904: Fix bug in the doctest module that caused it to fail if a docstring included an example with a classmethod property. Patch by Alex Waygood.
    • bpo-45406: Make inspect.getmodule() catch FileNotFoundError raised by :'func:inspect.getabsfile, and return None to indicate that the module could not be determined.
    • bpo-45262: Prevent use-after-free in asyncio. Make sure the cached running loop holder gets cleared on dealloc to prevent use-after-free in get_running_loop
    • bpo-45386: Make xmlrpc.client more robust to C runtimes where the underlying C strftime function results in a ValueError when testing for year formatting options.
    • bpo-45371: Fix clang rpath issue in distutils. The UnixCCompiler now uses correct clang option to add a runtime library directory (rpath) to a shared library.
    • bpo-20028: Improve error message of csv.Dialect when initializing.…

It was discovered that Python incorrectly handled certain RFCs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM. (CVE-2021-3733)

It was discovered that Python incorrectly handled certain server responses. An attacker could possibly use this issue to cause a denial of service. (CVE-2021-3737)

It was discovered that the urllib.request.AbstractBasicAuthHandler class in Python contains regex with a quadratic worst-case time complexity. Specially crafted traffic from a malicious HTTP server could cause a regular expression denial of service (ReDoS) condition for a client. (CVE-2021-3733)

It was discovered that the Python urllib http client could enter into an infinite loop when incorrectly handling certain server responses (100 Continue response). Specially crafted traffic from a malicious HTTP server could cause a denial of service (DoS) condition for a client. (CVE-2021-3737)