There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

🗓️ 02 Jun 2022 07:00:00Reported by MicrosoftType

mscve

mscve🔗 msrc.microsoft.com👁 5 Views

Flaw in urllib AbstractBasicAuthHandler enables ReDOS from a malicious server, risking availability.

Reporter	Title	Published	Views	Family All 300
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities found in Java, Node.js and IBM WebSphere Application Server Liberty	15 Apr 202502:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Guardium Insights is affected by multipe vulnerabilities	4 Feb 202221:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities (CVE-2022-34339, CVE-2021-3712, CVE-2021-3711, CVE-2021-4160, CVE-2021-29425, CVE-2021-3733, CVE-2021-3737, CVE-2022-0391, CVE-2021-43138, CVE-2022-24758)	26 Mar 202502:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm
IBM Security Bulletins	Security Bulletin: Python (Publicly disclosed vulnerability) in IBM Tivoli Application Dependency Discovery Manager (CVE-2021-3733)	18 Nov 202212:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	16 Jun 202315:20	–	ibm
IBM Security Bulletins	Security Bulletin: A buffer overread, security restrictions bypass, a use-after-free, and other vulnerabilities might affect IBM Storage Defender – Resiliency Service	25 Mar 202523:50	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Python (CVE-2021-3733)	22 Apr 202220:33	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Samba, OpenSSL, Python, and XStream affect IBM Spectrum Protect Plus (CVE-2021-20254, CVE-2021-3712, CVE-2021-43859, CVE-2022-0778, CVE-2020-25717, CVE-2021-23192, CVE-2021-3733)	30 Jun 202203:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Python	29 Jun 202202:19	–	ibm

Vulners

Node

microsoft cm1_python2_2.7.18-10Range<2.7.18-10

02 Jun 2022 07:00Current

7.5High risk

Vulners AI Score7.5

CVSS 24

CVSS 3.16.5

EPSS0.04675

urllib vulnerability basic authentication denial of service malicious server application availability