CVE-2021-3737

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces.

Security Fix(es):

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.(CVE-2021-3737)

There s a flaw in urllib s AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.(CVE-2021-3733)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Information disclosure via pydoc (CVE-2021-3426)

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

• python-ipaddress: Improper input validation of octal strings (CVE-2021-29921)

• python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

• python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python38 (3.8), python38-devel (3.8). (BZ#1997680, BZ#1997860)

Security Fix(es):

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

• python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

Security Fix(es):

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python: ftplib should not use the host from the PASV response (CVE-2021-4189)

• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

• python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: Information disclosure via pydoc (CVE-2021-3426)

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python-lxml: Missing input sanitization for formaction HTML5 attributes may lead to XSS (CVE-2021-28957)

• python-ipaddress: Improper input validation of octal strings (CVE-2021-29921)

• python-urllib3: ReDoS in the parsing of authority part of URL (CVE-2021-33503)

• python-pip: Incorrect handling of unicode separators in git references (CVE-2021-3572)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python38 (3.8), python38-devel (3.8). (BZ#1997680, BZ#1997860)

Security Fix(es):

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

• python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

Security Fix(es):

• python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733)

• python: ftplib should not use the host from the PASV response (CVE-2021-4189)

• python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through (CVE-2021-43818)

• python: urllib.parse does not sanitize URLs containing ASCII newline and tabs (CVE-2022-0391)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: ftplib should not use the host from the PASV response (CVE-2021-4189)

• python: urllib: HTTP client possible infinite loop on a 100 Continue response (CVE-2021-3737)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

• SECURITY UPDATE: Denial of service
  • debian/patches/CVE-2021-3737-*.patch: Fix http client infinite line reading (DoS) after a HTTP 100 continue in Lib/http/client.py, Lib/test/test_httplib.py.
  • CVE-2021-3737
• SECURITY UPDATE: Denial of service
  • debian/patches/CVE-2021-3733.patch: fix a ReDoS in urllib AbstractBasicAuthHandler in Lib/urllib/request.py.
  • CVE-2021-3733

• CVE-2021-3737: Fix HTTP client infinite line reading (DoS) after receiving a '100 Continue' HTTP response

• CVE-2021-3737: Fix HTTP client infinite line reading (DoS) after receiving a '100 Continue' HTTP response

• SECURITY UPDATE: Denial of service
  • debian/patches/CVE-2021-3737.patch: Fix http client infinite line reading (DoS) after a HTTP 100 continue in Lib/httplib.py, Lib/test/test_httplib.py.
  • CVE-2021-3737

• SECURITY UPDATE: Denial of service
  • debian/patches/CVE-2021-3737.patch: Fix http client infinite line reading (DoS) after a HTTP 100 continue in Lib/httplib.py, Lib/test/test_httplib.py.
  • CVE-2021-3737

• CVE-2021-3426: Remove the pydoc getfile feature which could lead to information disclosure (rhbz#1935913)
• CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response (rhbz#2036020)
• CVE-2021-4189: ftplib should not use the host from the PASV response (rhbz#2036020)
• CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs (rhbz#2047376)

• CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response (rhbz#2036020)
• CVE-2021-4189: ftplib should not use the host from the PASV response (rhbz#2036020)
• CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs (rhbz#2047376)

• CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler (rhbz#2047376)
• CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response (rhbz#2047376)
• CVE-2021-4189: ftplib should not use the host from the PASV response (rhbz#2047376)
• CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs (rhbz#2047376)

• CVE-2021-3733: urllib: Regular expression DoS in AbstractBasicAuthHandler (rhbz#2047376)
• CVE-2021-3737: urllib: HTTP client possible infinite loop on a 100 Continue response (rhbz#2047376)
• CVE-2021-4189: ftplib should not use the host from the PASV response (rhbz#2047376)
• CVE-2022-0391: urllib.parse does not sanitize URLs containing ASCII newline and tabs (rhbz#2047376)

• SECURITY UPDATE: Denial of service
  • debian/patches/CVE-2021-3737.patch: Fix http client infinite line reading (DoS) after a HTTP 100 continue in Lib/httplib.py, Lib/test/test_httplib.py.
  • CVE-2021-3737
• take building tests into account, fix failed tests
  • debian/patches/expat-regression.patch: fix failed expat tests
  • debain/patches/fix-test-sysconfig.patch: switch off some tests
  • debain/patches/fix-test-sysconfig2.patch: switch off some tests

• CVE-2021-3737: Fix http client infinite line reading (DoS) after a HTTP 100 Continue
• CVE-2021-28861: Fix an open redirection vulnerability in http.server
• CVE-2022-0391: Make urllib.parse sanitize urls containing ASCII newline and tabs
• CVE-2022-45061: Fix quadratic time idna decoding

• CVE-2022-45061: fix quadratic time idna decoding
• CVE-2021-3737: fix http client infinite line reading (DoS) after a HTTP 100 Continue

bpo-42278: Replaced usage of tempfile.mktemp() with TemporaryDirectory to avoid a potential race condition.

bpo-44394: Update the vendored copy of libexpat to 2.4.1 (from 2.2.8) to get the fix for the CVE-2013-0340 “Billion Laughs” vulnerability. This copy is most used on Windows and macOS.

bpo-43124: Made the internal putcmd function in smtplib sanitize input for presence of \r and \n characters to avoid (unlikely) command injection.

bpo-36384: ipaddress module no longer accepts any leading zeros in IPv4 address strings. Leading zeros are ambiguous and interpreted as octal notation by some libraries. For example the legacy function socket.inet_aton() treats leading zeros as octal notation. glibc implementation of modern inet_pton() does not accept any leading zeros. For a while the ipaddress module used to accept ambiguous leading zeros.

It was discovered that Python incorrectly handled certain RFCs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM. (CVE-2021-3733)

It was discovered that Python incorrectly handled certain server responses. An attacker could possibly use this issue to cause a denial of service. (CVE-2021-3737)

This update for python fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)
• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

This update was imported from the SUSE:SLE-15:Update update project.

This update for python fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)
• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

This update for python3 fixes the following issues:

• CVE-2021-3426: Fixed information disclosure via pydoc (bsc#1183374).

• CVE-2021-3733: Fixed infinitely reading potential HTTP headers after a 100 Continue status response from the server (bsc#1189241).

• CVE-2021-3737: Fixed ReDoS in urllib.request (bsc#1189287).

• We do not require python-rpm-macros package (bsc#1180125).

• Use versioned python-Sphinx to avoid dependency on other version of Python (bsc#1183858).

• Stop providing 'python' symbol, which means python2 currently (bsc#1185588).

• Modify Lib/ensurepip/init.py to contain the same version numbers as are in reality the ones in the bundled wheels (bsc#1187668).

These are all security issues fixed in the python-2.7.18-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-3.6.15-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.7-2.1 package on the GA media of openSUSE Tumbleweed.

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

This update for python3 fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)
• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

This update for python36 fixes the following issues:

• Update to 3.6.15:
• CVE-2021-3737: Fixed a DoS caused by infinitely reading potential HTTP headers after a 100 Continue status response from the server. (bsc#1189241)
• CVE-2021-3426: Fixed an information disclosure via pydoc. (bsc#1183374)
• CVE-2021-3733: Fixed a ReDoS in urllib.request. (bsc#1189287)

This update for python fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)
• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

This update for python fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)
• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

This update for python3 fixes the following issues:

• CVE-2021-3737: Fixed http client infinite line reading (DoS) after a http 100. (bsc#1189241)

• CVE-2021-3733: Fixed ReDoS in urllib.request. (bsc#1189287)

• CVE-2021-3426: Fixed an information disclosure via pydoc. (bsc#1183374)

• Rebuild to get new headers, avoid building in support for stropts.h (bsc#1187338).