Regular Expression Denial of Service in Python urllib - CVE-2021-3733
Summary
UBUNTU-CVE-2021-3733: There's a flaw in urllib's AbstractBasicAuthHandler class. Affects python3.4 versions < 3.4.3-1ubuntu1~14.04.7+esm11. Fixed in 3.4.3-1ubuntu1~14.04.7+esm11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python urllib package is a widely used library for handling URLs and making HTTP requests in Python applications. It provides functionalities for opening and reading URLs, handling various protocols, and managing authentication. This package is essential for developers who need to interact with web resources programmatically. However, it has been found to be vulnerable to a Regular Expression Denial of Service (ReDOS) attack, which can affect the availability of applications relying on this library.
Vulnerability Detail
CVE-2021-3733 is a vulnerability in the urllib's AbstractBasicAuthHandler class. An attacker controlling a malicious HTTP server can exploit this flaw by sending a specially crafted payload during an authentication request. This can lead to a Regular Expression Denial of Service (ReDOS), causing the application to become unresponsive. The vulnerability poses a significant threat to application availability, especially for those that rely heavily on HTTP communications.
How To Fix
Minimum fixed version
3.4.3-1ubuntu1~14.04.7+esm11
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider implementing input validation to sanitize user inputs and avoid sending potentially malicious requests to the server. Additionally, you can limit the types of requests your application accepts to mitigate the risk of exploitation.
Conclusion
CVE-2021-3733 represents a significant vulnerability in the Python urllib package that can lead to Denial of Service attacks. It is crucial for developers to update their packages to the patched versions to ensure the security and availability of their applications. Implementing input validation can also serve as a temporary workaround until the update is applied.
See every vulnerability recorded for python3.4 →
FAQ
CVE-2021-3733 is a vulnerability in the Python urllib package that allows for a Regular Expression Denial of Service (ReDOS) attack.
If your application uses urllib and connects to potentially malicious HTTP servers, it may become unresponsive due to this vulnerability.
The vulnerability affects multiple versions of Python, including 3.4, 3.5, 3.6, 3.7, 3.8, and 3.9.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without signing up.
The CVSS score for CVE-2021-3733 is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python3.4.
