Test ID:	1.3.6.1.4.1.25623.1.0.113639
Category:	Denial of Service
Title:	Python 2.7.x <= 2.7.17, 3.5 <= 3.5.9, 3.6.x <= 3.6.10, 3.7.x <= 3.7.6, 3.8.x <= 3.8.1 Regular Expression Denial of Service (ReDoS) Vulnerability - Mac OS X
Summary:	Python is prone to a Regular Expression Denial of Service; (ReDoS) vulnerability.
Description:	Summary: Python is prone to a Regular Expression Denial of Service (ReDoS) vulnerability. Vulnerability Insight: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression (catastrophic backtracking) which can be exploited by an attacker to cause a denial of service. Vulnerability Impact: Successful exploitation would allow an attacker to crash the application. Affected Software/OS: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1. Solution: Update to version 3.5.10, 3.6.11, 3.7.8, 3.8.3 or 3.9.0 respectively. CVSS Score: 7.1 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-8492 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/ https://security.gentoo.org/glsa/202005-09 https://bugs.python.org/issue39503 https://github.com/python/cpython/pull/18284 https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5@%3Ccommits.cassandra.apache.org%3E https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da@%3Ccommits.cassandra.apache.org%3E https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html SuSE Security Announcement: openSUSE-SU-2020:0274 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html https://usn.ubuntu.com/4333-1/ https://usn.ubuntu.com/4333-2/
Copyright	Copyright (C) 2020 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.