Resource exhaustion in urllib3 - CVE-2021-33503

Vulnerability identifier: #VU54077

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-33503

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in urllib3 when processing URL with multiple "@" characters in the authority component. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

urllib3
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux for Power, little endian
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Anolis OS
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Module for Basesystem
openEuler
Ubuntu
Fedora
Ansible Automation Platform
Netcool Operations Insight
IBM Process Mining
IBM Monitor Component
IBM Automation Decision Services
IBM Cloud Pak for Data System
Qradar Advisor
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Data Replication on Cloud Pak for Data
IBM Cloud Pak for Data Scheduling
IBM Spectrum Symphony
IBM Cloud Pak for Business Automation
python-urllib3 (Red Hat package)
python-requests (Red Hat package)
automation-hub (Red Hat package)
python-galaxy-ng (Red Hat package)
python39-wcwidth
python39-PyMySQL
python39-toml
python39-pluggy
python39-Cython
python39-wheel-wheel
python39-wheel
python39-iniconfig
python39-scipy
python39-pysocks
python39-py
python39-cffi
python39-six
python39-numpy
python39-numpy-f2py
python39-numpy-doc
python3-urllib3 (Ubuntu package)
python-urllib3
python3-urllib3
python2-urllib3
mingw-python-urllib3
python39-urllib3
python39-pyparsing
python39-pybind11-devel
python39-pybind11
python39-psycopg2-tests
python39-psycopg2-doc
python39-psycopg2
python39-idna
python39-pycparser
python-requests
python39-requests
python39-chardet
python39-cryptography
python39-libs
python39-tkinter
python39-test
python39-idle
python39-devel
python39-debug
python39
python39-rpm-macros
python39-ply
python39-lxml
python39-mod_wsgi
python39-pyyaml
python39-psutil
python39-pytest
python3-click (Red Hat package)
python39-more-itertools
python3-pip
python-pip-wheel
python-pip-help
python2-pip
python-pip
python39-pip-wheel
python39-pip
python39-attrs
python39-packaging
python39-setuptools
python39-setuptools-wheel
Cloud Pak for Network Automation
python-gitlab
Dell Policy Manager for Secure Connect Gateway (SCG)
QRadar Deployment Intelligence App
IBM Cloud Pak for Watson AIOps
IBM Watson Machine Learning Accelerator
Watson CP4D Data Stores
xDoctor4ECS
SOAR QRadar Plugin App
IBM Integrated Analytics System
Dell EMC AppSync
Operational Decision Manager

Install updates from vendor's website.

urllib3 - update to 1.26.5
Ansible Automation Platform - update to 1.2.5
Netcool Operations Insight - update to 1.6.4
IBM Process Mining - update to 2.0
python-urllib3 (Red Hat package) - update to 1.26.5-1.el7pc
Cloud Pak for Network Automation - update to 2.7.4
python-gitlab - update to 2.10.1
python-requests (Red Hat package) - update to 2.25.1-1.el7pc
automation-hub (Red Hat package) - update to 4.2.6-1.el7pc
python-galaxy-ng (Red Hat package) - update to 4.2.6-1.el7pc
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.12.00.00
IBM Monitor Component - addressed in versions 8.6.3, 8.7.1
IBM Automation Decision Services - update to 23.0.1 IF005
python39-wcwidth - update to 0.2.5-3
python39-PyMySQL - update to 0.10.1-2
python39-toml - update to 0.10.1-5
python39-pluggy - update to 0.13.1-3
python39-Cython - update to 0.29.21-5
python39-wheel-wheel - update to 0.35.1-4
python39-wheel - update to 0.35.1-4
IBM Integrated Analytics System - update to 1.0.30.0
python39-iniconfig - update to 1.1.1-2
python39-scipy - update to 1.5.4-3
python39-pysocks - update to 1.7.1-4
python39-py - update to 1.10.0-1
python39-cffi - update to 1.14.3-2
python39-six - update to 1.15.0-3
python39-numpy - update to 1.19.4-3
python39-numpy-f2py - update to 1.19.4-3
python39-numpy-doc - update to 1.19.4-3
python3-urllib3 (Ubuntu package) - update to 1.25.8-2ubuntu0.2
python-urllib3 - addressed in versions 1.25.8-5.fc33, 1.25.10-5.fc34
python3-urllib3 - update to 1.25.9-3
python2-urllib3 - update to 1.25.9-3
python-urllib3 - update to 1.25.9-3
mingw-python-urllib3 - update to 1.25.10-3.fc34
python39-urllib3 - update to 1.25.10-4
python3-urllib3 - update to 1.25.10-4.3.1
python-urllib3 - update to 1.25.10-5.19.1
IBM Cloud Pak for Data System - update to 2.0.2.1.IF1
python39-pyparsing - update to 2.4.7-5
Qradar Advisor - update to 2.6.2
python39-pybind11-devel - update to 2.7.1-1
python39-pybind11 - update to 2.7.1-1
python39-psycopg2-tests - update to 2.8.6-2.0.1
python39-psycopg2-doc - update to 2.8.6-2.0.1
python39-psycopg2 - update to 2.8.6-2.0.1
python39-idna - update to 2.10-3
python39-pycparser - update to 2.20-3
python-requests - update to 2.24.0-3.3.1
python39-requests - update to 2.25.0-2
python39-chardet - update to 3.0.4-19
QRadar Deployment Intelligence App - update to 3.0.16
python39-cryptography - update to 3.3.1-2
IBM Cloud Pak for Watson AIOps - update to 3.5
python39-libs - update to 3.9.7-1.0.1
python39-tkinter - update to 3.9.7-1.0.1
python39-test - update to 3.9.7-1.0.1
python39-idle - update to 3.9.7-1.0.1
python39-devel - update to 3.9.7-1.0.1
python39-debug - update to 3.9.7-1.0.1
python39 - update to 3.9.7-1.0.1
python39-rpm-macros - update to 3.9.7-1.0.1
python39-ply - update to 3.11-10
IBM Watson Machine Learning Accelerator - update to 4.0
Dell EMC AppSync - update to 4.4.1.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.5.1
python39-lxml - update to 4.6.5-1
Watson CP4D Data Stores - update to 4.7.0
Data Replication on Cloud Pak for Data - update to 4.7.1
python39-mod_wsgi - update to 4.7.1-4
IBM Cloud Pak for Data Scheduling - update to 4.8.0
xDoctor4ECS - update to 4.8-84.0
SOAR QRadar Plugin App - update to 5.4.0
python39-pyyaml - update to 5.4.1-1
python39-psutil - update to 5.8.0-4.0.1
python39-pytest - update to 6.0.2-2
python3-click (Red Hat package) - update to 7.1.2-3.el7pc
IBM Spectrum Symphony - update to 7.3.2 Fix 601860
python39-more-itertools - update to 8.5.0-2
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 49, 8.11.0.1 Interim fix 26, 8.12.0 Interim fix 8
python3-pip - update to 20.2.2-6
python-pip-wheel - update to 20.2.2-6
python-pip-help - update to 20.2.2-6
python2-pip - update to 20.2.2-6
python-pip - update to 20.2.2-6
python39-pip-wheel - update to 20.2.4-7
python39-pip - update to 20.2.4-7
python39-attrs - update to 20.3.0-2
python39-packaging - update to 20.4-4
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.27, 23.0.1.5
python39-setuptools - update to 50.3.2-4
python39-setuptools-wheel - update to 50.3.2-4

• https://github.com/urllib3/urllib3/security/advisories/GHSA-q2q7-5pp4-w6pg
• https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec

• Arch Linux update for python-urllib3
• Denial of service in urllib3
• Gentoo update for urllib3
• Denial of service in python-gitlab
• Denial of service in Red Hat Automation Platform
• Multiple vulnerabilities in IBM Monitor Component
• Multiple vulnerabilities in IBM Netcool Operations Insight
• SUSE update for python-urllib3
• SUSE update for python-urllib3, python-requests
• Multiple vulnerabilities in Dell Policy Manager for Secure Connect Gateway
• Multiple vulnerabilities in IBM QRadar Advisor
• Multiple vulnerabilities in Dell EMC AppSync
• Multiple Vulnerabilities in IBM CloudPak for Watson AIOPs
• Multiple vulnerabilities in Dell xDoctor4ECS
• Resource exhaustion in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Ubuntu update for python-urllib3
• Resource exhaustion in IBM Watson CP4D Data Stores
• Multiple vulnerabilities in IBM Cloud Pak for Data Scheduling
• Multiple vulnerabilities in IBM Automation Decision Services
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Spectrum Symphony
• Resource exhaustion in IBM Cloud Pak for Data System
• openEuler 20.03 LTS SP1 update for python-urllib3
• openEuler 20.03 LTS SP3 update for python-pip
• openEuler 20.03 LTS SP1 update for python-pip
• Multiple vulnerabilities in IBM SOAR QRadar Plugin App
• Resource exhaustion in Data Replication on Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• IBM Integrated Analytics System update for urllib3
• Red Hat Enterprise Linux 8 update for the python39:3.9 and python39-devel:3.9 modules
• Red Hat Enterprise Linux 8 update for the python38:3.8 and python38-devel:3.8 modules
• Fedora 34 update for mingw-python-urllib3
• Fedora 34 update for python-urllib3
• Fedora 33 update for python-urllib3
• Multiple vulnerabilities in IBM QRadar Deployment Intelligence App
• Anolis OS update for python39:3.9 module
• Multiple vulnerabilities in IBM Process Mining