Lucene search

[email protected]NVD:CVE-2021-28861

HistoryAug 23, 2022 - 1:15 a.m.

CVE-2021-28861

2022-08-2301:15:07

CWE-601

[email protected]

web.nvd.nist.gov

python

open redirection

uri path

information disclosure

http server

security checks

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

0.002

Percentile

59.7%

JSON

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states “Warning: http.server is not recommended for production. It only implements basic security checks.”

Affected configurations

Nvd

Node

pythonpythonRange3.0.0–3.7.14

pythonpythonRange3.8.0–3.8.14

pythonpythonRange3.9.0–3.9.14

pythonpythonRange3.10.0–3.10.6

pythonpythonMatch3.11.0alpha1

pythonpythonMatch3.11.0alpha2

pythonpythonMatch3.11.0alpha3

pythonpythonMatch3.11.0alpha4

pythonpythonMatch3.11.0alpha5

pythonpythonMatch3.11.0alpha6

pythonpythonMatch3.11.0alpha7

pythonpythonMatch3.11.0beta1

pythonpythonMatch3.11.0beta2

pythonpythonMatch3.11.0beta3

Node

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

fedoraprojectfedoraMatch37

VendorProductVersionCPE
pythonpython*cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha1:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha2:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha3:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha4:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha5:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha6:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha7:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:beta1:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:beta2:*:*:*:*:*:*

Vendor	Product	Version	CPE
python	python	*	cpe:2.3:a:python:python::::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha1::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha2::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha3::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha4::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha5::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha6::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha7::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:beta1::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:beta2::::::

Rows per page:

1-10 of 141

References

bugs.python.org/issue43223

github.com/python/cpython/pull/24848

github.com/python/cpython/pull/93879

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2TRINJE3INWDVIHIABW4L2NP3RUSK7BJ/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LTSPFIULY2GZJN3QYNFVM4JSU6H4D6J/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OABQ5CMPQETJLFHROAXDIDXCMDTNVYG/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DISZAFSIQ7IAPAEQTC7G2Z5QUA2V2PSW/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPX4XHT2FGVQYLY2STT2MRVENILNZTTU/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I3MQT5ZE3QH5PVDJMERTBOCILHK35CBE/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRGKPYA5YHIXQAMRIXO5DSCX7D4UUW4Q/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLE5INSVJUZJGY5OJXV6JREXWD7UDHYN/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G66SRWUM36ENQ3X6LAIG7HAB27D4XJ/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZEPOPUFC42KXXSLFPZ47ZZRGPOR7SQE/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X46T4EFTIBXZRYTGASBDEZGYJINH2OWV/

security.gentoo.org/glsa/202305-02

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

0.002

Percentile

59.7%

JSON

Related for NVD:CVE-2021-28861

openvas43 prion1 nessus57 osv10 cve1 fedora14 ibm7 debiancve1 suse4 ubuntucve1 ubuntu2 veracode1 redhatcve1 cvelist1 cbl_mariner2 oraclelinux4 almalinux4 rocky2 redhat20 photon4 mageia1 gentoo1 oracle1 ics1 avleonov1