Resource management error in Python - CVE-2020-8492

Vulnerability identifier: #VU25631

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-8492

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in urllib.request.AbstractBasicAuthHandler when processing HTTP responses. A remote attacker who controls a HTTP server can send a specially crafted HTTP response to the client application and conduct Regular Expression Denial of Service (ReDoS) attack.

Python
Gentoo Linux
Amazon Linux AMI
Arch Linux
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
Fedora
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
Opensuse
openSUSE Leap
Red Hat OpenShift Serverless
Quay
OpenShift Data Foundation (formerly OpenShift Container Storage)
python3 (Alpine package)
python3 (Red Hat package)
python3.5-minimal (Ubuntu package)
python3.5 (Ubuntu package)
python3.7-minimal (Ubuntu package)
python3.11-minimal (Ubuntu package)
python3.11 (Ubuntu package)
python3.8 (Ubuntu package)
python3.8-minimal (Ubuntu package)
python3.9 (Ubuntu package)
python3.7 (Ubuntu package)
python3.9-minimal (Ubuntu package)
python3.6 (Ubuntu package)
python3.6-minimal (Ubuntu package)
python38-wcwidth
python38-PyMySQL
python38-pluggy
python38-Cython
python38-wheel-wheel
python38-wheel
python38-markupsafe
python38-asn1crypto
python38-atomicwrites
python38-scipy
python38-pysocks
python38-py
python38-six
python38-cffi
python38-numpy
python38-numpy-f2py
python38-numpy-doc
python38-urllib3
python38-pyparsing
python38-babel
python2.7-minimal (Ubuntu package)
python2.7 (Ubuntu package)
python38-cryptography
python38-psycopg2
python38-psycopg2-doc
python38-psycopg2-tests
python38-idna
python38-jinja2
python38-pycparser
python38-requests
python38-chardet
python34
python36
python3-doc-devhelp
python3-doc
libpython3_6m1_0-32bit-debuginfo
libpython3_6m1_0
libpython3_6m1_0-debuginfo
python3
python3-base
python3-base-debuginfo
python3-core-debugsource
python3-debuginfo
python3-debugsource
python3-curses
python3-curses-debuginfo
python3-dbm
python3-devel
python3-devel-debuginfo
python3-idle
python3-testsuite
python3-testsuite-debuginfo
python3-tk
python3-tk-debuginfo
python3-tools
libpython3_6m1_0-32bit
python3-dbm-debuginfo
libpython3.7-stdlib (Ubuntu package)
libpython3.8-stdlib (Ubuntu package)
python38
python38-rpm-macros
python38-tkinter
python38-debug
python38-devel
python38-idle
python38-libs
python38-test
python3.10 (Ubuntu package)
python3.10-minimal (Ubuntu package)
python38-ply
python3.12-minimal (Ubuntu package)
python3.12 (Ubuntu package)
python38-lxml
python38-pytest
python38-mod_wsgi
python38-pyyaml
python38-psutil
python38-more-itertools
python38-packaging
python38-attrs
python38-pip
python38-pip-wheel
python38-setuptools-wheel
python38-setuptools
python38-pytz
Red Hat OpenShift Container Platform
IBM Robotic Process Automation
Junos Space Security Director

Install update from vendor's website.

Python - addressed in versions 3.6.11, 3.7.7, 3.8.3
Red Hat OpenShift Serverless - addressed in versions 1.10.2, 1.11.0
Quay - update to 3.3.3
python3 (Alpine package) - addressed in versions 3.7.7-r0, 3.8.2-r1
python3 (Red Hat package) - addressed in versions 3.6.8-17.el7, 3.6.8-31.el8
python3.5-minimal (Ubuntu package) - update to Ubuntu Pro
python3.5 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
python3.7-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.7.5-2ubuntu1~18.04.2, 3.7.5-2~18.04.4
python3.11-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.11 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.8 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.0-3ubuntu1~18.04.2, 3.8.0-3~18.04.1, 3.8.10-0ubuntu1~20.04.10
python3.8-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.0-3ubuntu1~18.04.2, 3.8.0-3~18.04.1, 3.8.10-0ubuntu1~20.04.10
python3.9 (Ubuntu package) - update to Ubuntu Pro
python3.7 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.7.5-2ubuntu1~18.04.2, 3.7.5-2~18.04.4
python3.9-minimal (Ubuntu package) - update to Ubuntu Pro
python3.6 (Ubuntu package) - update to Ubuntu Pro
python3.6-minimal (Ubuntu package) - update to Ubuntu Pro
python38-wcwidth - update to 0.1.7-16
python38-PyMySQL - update to 0.10.1-1
python38-pluggy - update to 0.13.0-3
python38-Cython - update to 0.29.14-4
python38-wheel-wheel - update to 0.33.6-6
python38-wheel - update to 0.33.6-6
python38-markupsafe - update to 1.1.1-6
python38-asn1crypto - update to 1.2.0-3
python38-atomicwrites - update to 1.3.0-8
python38-scipy - update to 1.3.1-4
python38-pysocks - update to 1.7.1-4
python38-py - update to 1.8.0-8
python38-six - update to 1.12.0-10
python38-cffi - update to 1.13.2-3
python38-numpy - update to 1.17.3-6
python38-numpy-f2py - update to 1.17.3-6
python38-numpy-doc - update to 1.17.3-6
python38-urllib3 - update to 1.25.7-5
python38-pyparsing - update to 2.4.5-3
python38-babel - update to 2.7.0-11
python2.7-minimal (Ubuntu package) - update to 2.7.18-1~20.04.1
python2.7 (Ubuntu package) - update to 2.7.18-1~20.04.1
python38-cryptography - update to 2.8-3
python38-psycopg2 - update to 2.8.4-4
python38-psycopg2-doc - update to 2.8.4-4
python38-psycopg2-tests - update to 2.8.4-4
python38-idna - update to 2.8-6
python38-jinja2 - update to 2.10.3-5
python38-pycparser - update to 2.19-3
python38-requests - update to 2.22.0-9
python38-chardet - update to 3.0.4-19
python34 - update to 3.4.10-5.el7
python36 - addressed in versions 3.6.11-1.fc31, 3.6.11-1.fc32
python3-doc-devhelp - update to 3.6.15-150300.10.37.1
python3-doc - update to 3.6.15-150300.10.37.1
libpython3_6m1_0-32bit-debuginfo - update to 3.6.15-150300.10.37.2
libpython3_6m1_0 - update to 3.6.15-150300.10.37.2
libpython3_6m1_0-debuginfo - update to 3.6.15-150300.10.37.2
python3 - update to 3.6.15-150300.10.37.2
python3-base - update to 3.6.15-150300.10.37.2
python3-base-debuginfo - update to 3.6.15-150300.10.37.2
python3-core-debugsource - update to 3.6.15-150300.10.37.2
python3-debuginfo - update to 3.6.15-150300.10.37.2
python3-debugsource - update to 3.6.15-150300.10.37.2
python3-curses - update to 3.6.15-150300.10.37.2
python3-curses-debuginfo - update to 3.6.15-150300.10.37.2
python3-dbm - update to 3.6.15-150300.10.37.2
python3-devel - update to 3.6.15-150300.10.37.2
python3-devel-debuginfo - update to 3.6.15-150300.10.37.2
python3-idle - update to 3.6.15-150300.10.37.2
python3-testsuite - update to 3.6.15-150300.10.37.2
python3-testsuite-debuginfo - update to 3.6.15-150300.10.37.2
python3-tk - update to 3.6.15-150300.10.37.2
python3-tk-debuginfo - update to 3.6.15-150300.10.37.2
python3-tools - update to 3.6.15-150300.10.37.2
libpython3_6m1_0-32bit - update to 3.6.15-150300.10.37.2
python3-dbm-debuginfo - update to 3.6.15-150300.10.37.2
libpython3.7-stdlib (Ubuntu package) - update to 3.7.5-2ubuntu1~18.04.2
libpython3.8-stdlib (Ubuntu package) - update to 3.8.0-3ubuntu1~18.04.2
python38 - addressed in versions 3.8.3-1.fc30, 3.8.3-1.fc31
python3 - update to 3.8.3-1.fc32
python38 - update to 3.8.12-1.0.1
python38-rpm-macros - update to 3.8.12-1.0.1
python38-tkinter - update to 3.8.12-1.0.1
python38-debug - update to 3.8.12-1.0.1
python38-devel - update to 3.8.12-1.0.1
python38-idle - update to 3.8.12-1.0.1
python38-libs - update to 3.8.12-1.0.1
python38-test - update to 3.8.12-1.0.1
python3.10 (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.10-minimal (Ubuntu package) - update to 3.10.12-1~22.04.4
python38-ply - update to 3.11-10
python3.12-minimal (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python3.12 (Ubuntu package) - update to 3.12.0-1ubuntu0.1
Red Hat OpenShift Container Platform - update to 4.3.40
python38-lxml - update to 4.4.1-7
python38-pytest - update to 4.6.6-3
python38-mod_wsgi - update to 4.6.8-3
python38-pyyaml - update to 5.4.1-1
python38-psutil - update to 5.6.4-4
python38-more-itertools - update to 7.2.0-5
python38-packaging - update to 19.2-3
python38-attrs - update to 19.3.0-3
python38-pip - update to 19.3.1-5
python38-pip-wheel - update to 19.3.1-5
IBM Robotic Process Automation - update to 21.0.5
Junos Space Security Director - update to 24.1R3
python38-setuptools-wheel - update to 41.6.0-5
python38-setuptools - update to 41.6.0-5
python38-pytz - update to 2019.3-3

• https://bugs.python.org/issue39503
• https://github.com/python/cpython/pull/18284
• https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html
• https://security.netapp.com/advisory/ntap-20200221-0001/

• Denial of service in Python
• OpenSUSE Linux update for python3
• Gentoo update for Python
• Amazon Linux AMI update for python27, python34, python35, python36
• Amazon Linux AMI update for python26
• Resource management error in python3 (Alpine package)
• Red Hat Enterprise Linux 7 update for python3
• Red Hat Enterprise Linux 8 update for the python38:3.8 module
• Red Hat Enterprise Linux 8 update for python3
• Multiple vulnerabilities in Red Hat Openshift Serverless
• Multiple vulnerabilities in Red Hat OpenShift Container Storage
• Multiple vulnerabilities in Red Hat Quay
• Arch Linux update for python2
• Multiple vulnerabilities in Red Hat OpenShift Serverless
• Ubuntu update for python2.7
• Ubuntu update for python3.7
• SUSE update for python3
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Ubuntu update for python3.10
• Anolis OS update for python38:3.8 module
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.3
• Fedora EPEL 7 update for python34
• Fedora 32 update for python3
• Fedora 31 update for python38
• Fedora 30 update for python38
• Fedora 31 update for python36
• Fedora 32 update for python36
• Multiple vulnerabilities in Junos Space Security Director Policy Enforcer module