Vulnerability · Published Jan 30, 2020 · Assigned by mitre

CVE-2020-8492

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in the python38-Cython package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.6% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)6.6%top 6.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	python38-Cython	0.29.14-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-asn1crypto	1.2.0-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-cffi	1.13.2-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-chardet	3.0.4-19.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-cryptography	2.8-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-idna	2.8-6.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-markupsafe	1.1.1-6.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-mod_wsgi	4.6.8-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-psycopg2	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-psycopg2-doc	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-psycopg2-tests	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-pycparser	2.19-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-pysocks	1.7.1-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-pytz	2019.3-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-requests	2.22.0-9.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-scipy	1.3.1-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
Alpine:v3.20	python3	3.8.2-r0	ALPINE-CVE-2020-8492
Alpine:v3.21	python3	3.8.2-r0	ALPINE-CVE-2020-8492
Alpine:v3.22	python3	3.8.2-r0	ALPINE-CVE-2020-8492
Alpine:v3.23	python3	3.8.2-r0	ALPINE-CVE-2020-8492
Alpine:v3.24	python3	3.8.2-r0	ALPINE-CVE-2020-8492
Rocky Linux:8	Cython	0:0.29.14-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	PyYAML	0:5.3.1-1.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	babel	0:2.7.0-10.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	mod_wsgi	0:4.6.8-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	numpy	0:1.17.3-5.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-asn1crypto	0:1.2.0-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-cffi	0:1.13.2-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-chardet	0:3.0.4-19.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-cryptography	0:2.8-3.module+el8.5.0+672+ab6eb015	RLSA-2020:4641
Rocky Linux:8	python-cryptography	0:2.8-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-idna	0:2.8-6.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-jinja2	0:2.10.3-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-markupsafe	0:1.1.1-6.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-psutil	0:5.6.4-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-psycopg2	0:2.8.4-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-psycopg2	0:2.8.4-4.module+el8.6.0+794+eba84017	RLSA-2020:4641
Rocky Linux:8	python-pycparser	0:2.19-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-pysocks	0:1.7.1-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-requests	0:2.22.0-9.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-urllib3	0:1.25.7-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-wheel	0:0.33.6-5.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python3x-pip	0:19.3.1-1.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python3x-setuptools	0:41.6.0-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	pytz	0:2019.3-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	scipy	0:1.3.1-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	scipy	0:1.3.1-4.module+el8.5.0+672+ab6eb015	RLSA-2020:4641
Ubuntu:22.04:LTS	python3.10	3.10.12-1~22.04.4	USN-6891-1

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://bugs.python.org/issue39503
https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html
https://github.com/python/cpython/pull/18284
https://security.netapp.com/advisory/ntap-20200221-0001/
openSUSE-SU-2020:0274 vendor-advisory
USN-4333-1 vendor-advisory
USN-4333-2 vendor-advisory
GLSA-202005-09 vendor-advisory
FEDORA-2020-98e0f0f11b vendor-advisory
FEDORA-2020-6a88dad4a0 vendor-advisory
FEDORA-2020-8bdd3fd7a4 vendor-advisory
FEDORA-2020-ea5bdbcc90 vendor-advisory
[debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security update mailing-list
[cassandra-commits] 20210816 [jira] [Created] (CASSANDRA-16857) Security vulnerability CVE-2020-8492 mailing-list
[cassandra-commits] 20210816 [jira] [Updated] (CASSANDRA-16857) Security vulnerability CVE-2020-8492 mailing-list
[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update mailing-list
https://cert-portal.siemens.com/productcert/html/ssa-398330.html