Critical CPU Consumption Vulnerability in Python Packages: CVE-2021-3737
Summary
UBUNTU-CVE-2021-3737: A flaw was found in python. Affects python3.4 versions < 3.4.3-1ubuntu1~14.04.7+esm11. Fixed in 3.4.3-1ubuntu1~14.04.7+esm11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility in various applications, including web development, data analysis, artificial intelligence, and more. The affected packages, including python3.4, python3.5, python3.6, python3.7, python3.8, and python3.9, are essential components of the Python ecosystem, providing libraries and tools for developers. This vulnerability exposes these packages to potential denial-of-service attacks due to improper handling of HTTP responses.
Vulnerability Detail
A flaw was discovered in the Python HTTP client code that allows a remote attacker controlling an HTTP server to manipulate the client script into entering an infinite loop. This can lead to excessive CPU consumption, potentially resulting in system unavailability. The vulnerability is identified as CVE-2021-3737 and has a CVSS score of 7.5, indicating a medium to high severity level.
How To Fix
Minimum fixed version
3.4.3-1ubuntu1~14.04.7+esm11
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing network-level controls to restrict access to the vulnerable HTTP endpoints or using alternative libraries that do not exhibit this flaw until the packages can be updated.
Conclusion
CVE-2021-3737 is a significant vulnerability affecting multiple Python packages, leading to potential denial-of-service attacks through excessive CPU consumption. It is essential to update the affected packages to their patched versions to ensure system security and availability.
See every vulnerability recorded for python3.4 →
FAQ
CVE-2021-3737 is a vulnerability in Python's HTTP client code that can lead to excessive CPU consumption due to an infinite loop triggered by a malicious HTTP server.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary impact is denial of service, where the application may become unresponsive due to high CPU usage, affecting system availability.
Yes, patched versions of the affected Python packages are available. It is recommended to update to these versions to mitigate the risk.
If immediate updates are not possible, consider implementing network restrictions to limit access to vulnerable endpoints as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for python3.4.
