Home > Vulnerability Database > CVE-2020-8492

Mend.io Vulnerability Database

CVE-2020-8492

Good to know:

Date: January 29, 2020

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Language: Python

Severity Score

6.5

Related Resources (29)

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/

Url: https://github.com/python/cpython/pull/18284

Url: https://usn.ubuntu.com/4333-1/

Url: https://security-tracker.debian.org/tracker/CVE-2020-8492

Url: https://bugs.python.org/issue39503

Url: https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da@%3Ccommits.cassandra.apache.org%3E

Url: https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2020-8492

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/

Url: https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html

Url: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html

Url: https://usn.ubuntu.com/4333-2/

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/

Url: https://bugs.python.org/issue38826

Url: https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E

Url: https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/

Url: https://access.redhat.com/security/cve/CVE-2020-8492

Url: https://nvd.nist.gov/vuln/detail/CVE-2020-8492

Url: https://security.gentoo.org/glsa/202005-09

Url: https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5%40%3Ccommits.cassandra.apache.org%3E

Url: https://security.netapp.com/advisory/ntap-20200221-0001/

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/

Url: https://security.alpinelinux.org/vuln/CVE-2020-8492

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/

Url: https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5@%3Ccommits.cassandra.apache.org%3E

Url: https://www.mend.io/vulnerability-database/CVE-2020-8492

Severity Score

6.5

Weakness Type (CWE)

Uncontrolled Resource Consumption ('Resource Exhaustion')

CWE-400

Top Fix

Upgrade Version

Upgrade to version 3.5.3-1+deb9u2, 3.7.3-2+deb10u2, 3.8.3~rc1-1

Learn More

CVSS v3.1

Base Score:	6.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	HIGH

CVSS v2

Base Score:	7.1
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	COMPLETE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2020-8492

Good to know:

Date: January 29, 2020

Language: Python

Severity Score

Related Resources (29)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?