Resource management error in Python - CVE-2021-3733

Vulnerability identifier: #VU58295

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3733

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application within the AbstractBasicAuthHandler class in urllib. A remote attacker with control over the server can perform regular expression denial of service attack during authentication.

Python
Amazon Linux AMI
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE MicroOS
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Anolis OS
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE Linux Enterprise Module for Web Scripting
SUSE Linux Enterprise Server
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Python2
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
openEuler
Fedora
cflinuxfs3
PowerStore T
PowerStore X
OpenManage Network Integration (OMNI)
Enterprise SONiC
Red Hat Software Collections
python27-python (Red Hat package)
python27-python-pip (Red Hat package)
python3.5-minimal (Ubuntu package)
python3.5 (Ubuntu package)
python3.7-minimal (Ubuntu package)
python3.11 (Ubuntu package)
python3.11-minimal (Ubuntu package)
python3.8 (Ubuntu package)
python3.8-minimal (Ubuntu package)
python3.9 (Ubuntu package)
python3.9-minimal (Ubuntu package)
python3.6 (Ubuntu package)
python3.6-minimal (Ubuntu package)
python3.7 (Ubuntu package)
python38-wcwidth
python38-PyMySQL
python38-pluggy
python38-Cython
python38-wheel
python38-wheel-wheel
python38-markupsafe
python38-asn1crypto
python38-atomicwrites
python38-scipy
python38-pysocks
python38-py
python38-six
python38-cffi
python38-numpy
python38-numpy-f2py
python38-numpy-doc
python38-urllib3
python38-pyparsing
python38-babel
python2.7
python-curses-debuginfo
python-doc-pdf
python-debuginfo
python-debugsource
python-demo
python-gdbm
python-gdbm-debuginfo
python-idle
python-tk
python-tk-debuginfo
python-32bit
python-debuginfo-32bit
python-doc
python-curses
python
python-base
python-base-debuginfo-32bit
python-base-32bit
libpython2_7-1_0-debuginfo-32bit
libpython2_7-1_0-32bit
python-xml-debuginfo
python-xml
python-base-debuginfo
python-base-debugsource
python-devel
libpython2_7-1_0
libpython2_7-1_0-debuginfo
python38-cryptography
python38-psycopg2-tests
python38-psycopg2-doc
python38-psycopg2
python38-idna
python38-jinja2
python38-pycparser
python38-requests
python38-chardet
python3-base-debuginfo-32bit
libpython3_4m1_0-debuginfo-32bit
libpython3_4m1_0-32bit
python3-tk
python3-tk-debuginfo
python3-curses-debuginfo
python3-base-debuginfo
python3-base-debugsource
python3-dbm
python3-dbm-debuginfo
python3-debuginfo
python3-debugsource
python3-devel
python3-devel-debuginfo
libpython3_4m1_0
libpython3_4m1_0-debuginfo
python3
python3-base
python3-curses
python3.4-minimal (Ubuntu package)
python3.4 (Ubuntu package)
python3 (Red Hat package)
platform-python
platform-python-debug
platform-python-devel
python3-idle
python3-libs
python3-test
python3-tkinter
libpython3.6-stdlib (Ubuntu package)
libpython3_6m1_0-debuginfo
libpython3_6m1_0
python3-testsuite
python3-tools
python3-core-debugsource
python36
python36-base
python36-base-debuginfo
python36-debuginfo
python36-debugsource
libpython3.7-stdlib (Ubuntu package)
python3-debug
python3-help
libpython3.8-stdlib (Ubuntu package)
python38-rpm-macros
python38-debug
python38
python38-devel
python38-idle
python38-tkinter
python38-test
python38-libs
mingw-python3
python39-testsuite
python39-doc
python39-doc-devhelp
python39-devel
python39-core-debugsource
python39-base-debuginfo
python39-base
libpython3_9-1_0-debuginfo
libpython3_9-1_0
python39-base-32bit-debuginfo
python39-tools
libpython3_9-1_0-32bit
python39-testsuite-debuginfo
libpython3_9-1_0-32bit-debuginfo
python39-base-32bit
python39-debugsource
python39
python39-curses
python39-curses-debuginfo
python39-dbm
python39-32bit-debuginfo
python39-dbm-debuginfo
python39-debuginfo
python39-32bit
python39-idle
python39-tk-debuginfo
python39-tk
python3.10-minimal (Ubuntu package)
python3.10 (Ubuntu package)
python38-ply
python3.12-minimal (Ubuntu package)
python3.12 (Ubuntu package)
python38-lxml
python38-pytest
python38-mod_wsgi
python38-pyyaml
python38-psutil
python38-more-itertools
python38-packaging
python38-attrs
python38-pip-wheel
python38-pip
python38-setuptools
python38-setuptools-wheel
python38-pytz
Dell Secure Connect Gateway
IBM Sterling Control Center
IBM Spectrum Protect Plus
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Transformation Advisor
IBM Tivoli Application Dependency Discovery Manager
Cloud Pak for Security (CP4S)
Dell Enterprise SONiC Distribution
IBM Qradar SIEM
Red Hat OpenShift Serverless
OpenShift Virtualization
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
IBM Cognos Analytics
Junos Space Security Director

Install updates from vendor's website.

Python - addressed in versions 3.6.14, 3.7.11, 3.8.10, 3.9.5
cflinuxfs3 - update to 0.271.0
python27-python (Red Hat package) - update to 2.7.18-4.el7
Dell Secure Connect Gateway - update to 5.12.00.10
IBM Sterling Control Center - update to 6.1.3.0.14
python27-python-pip (Red Hat package) - update to 8.1.2-7.el7
IBM Spectrum Protect Plus - update to 10.1.11
python3.5-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.5.22ubuntu0~16.04.13+esm1
python3.5 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 3.5.22ubuntu0~16.04.13+esm1
python3.7-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.7.5-2ubuntu1~18.04.2
python3.11 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.11-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.11.6-3ubuntu0.1
python3.8 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.0-3ubuntu1~18.04.2, 3.8.10-0ubuntu1~20.04.10
python3.8-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.8.0-3ubuntu1~18.04.2, 3.8.10-0ubuntu1~20.04.10
python3.9 (Ubuntu package) - update to Ubuntu Pro
python3.9-minimal (Ubuntu package) - update to Ubuntu Pro
python3.6 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.6.9-1~18.04ubuntu1.6
python3.6-minimal (Ubuntu package) - addressed in versions Ubuntu Pro, 3.6.9-1~18.04ubuntu1.6
python3.7 (Ubuntu package) - addressed in versions Ubuntu Pro, 3.7.5-2ubuntu1~18.04.2
python38-wcwidth - update to 0.1.7-16
python38-PyMySQL - update to 0.10.1-1
python38-pluggy - update to 0.13.0-3
python38-Cython - update to 0.29.14-4
python38-wheel - update to 0.33.6-6
python38-wheel-wheel - update to 0.33.6-6
python38-markupsafe - update to 1.1.1-6
python38-asn1crypto - update to 1.2.0-3
python38-atomicwrites - update to 1.3.0-8
python38-scipy - update to 1.3.1-4
python38-pysocks - update to 1.7.1-4
python38-py - update to 1.8.0-8
Cloud Pak for Security (CP4S) - update to 1.10.10.0
python38-six - update to 1.12.0-10
python38-cffi - update to 1.13.2-3
python38-numpy - update to 1.17.3-6
python38-numpy-f2py - update to 1.17.3-6
python38-numpy-doc - update to 1.17.3-6
Red Hat OpenShift Serverless - update to 1.19.0
python38-urllib3 - update to 1.25.7-5
Red Hat Advanced Cluster Management for Kubernetes - update to 2.2.10
python38-pyparsing - update to 2.4.5-3
OpenShift Virtualization - update to 2.6.8
python38-babel - update to 2.7.0-11
python2.7 - addressed in versions 2.7.18-15.fc33, 2.7.18-15.fc34, 2.7.18-15.fc35, 2.7.18-15.fc36
python-curses-debuginfo - addressed in versions 2.7.18-28.74.1, 2.7.18-33.1
python-doc-pdf - update to 2.7.18-28.74.1
python-debuginfo - addressed in versions 2.7.18-28.74.1, 2.7.18-33.1
python-debugsource - addressed in versions 2.7.18-28.74.1, 2.7.18-33.1
python-demo - update to 2.7.18-28.74.1
python-gdbm - addressed in versions 2.7.18-28.74.1, 2.7.18-33.1
python-gdbm-debuginfo - addressed in versions 2.7.18-28.74.1, 2.7.18-33.1
python-idle - update to 2.7.18-28.74.1
python-tk - addressed in versions 2.7.18-28.74.1, 2.7.18-33.1
python-tk-debuginfo - addressed in versions 2.7.18-28.74.1, 2.7.18-33.1
python-32bit - update to 2.7.18-28.74.1
python-debuginfo-32bit - update to 2.7.18-28.74.1
python-doc - update to 2.7.18-28.74.1
python-curses - addressed in versions 2.7.18-28.74.1, 2.7.18-33.1
python - addressed in versions 2.7.18-28.74.1, 2.7.18-33.1
python-base - addressed in versions 2.7.18-28.74.2, 2.7.18-33.1
python-base-debuginfo-32bit - update to 2.7.18-28.74.2
python-base-32bit - update to 2.7.18-28.74.2
libpython2_7-1_0-debuginfo-32bit - update to 2.7.18-28.74.2
libpython2_7-1_0-32bit - update to 2.7.18-28.74.2
python-xml-debuginfo - addressed in versions 2.7.18-28.74.2, 2.7.18-33.1
python-xml - addressed in versions 2.7.18-28.74.2, 2.7.18-33.1
python-base-debuginfo - addressed in versions 2.7.18-28.74.2, 2.7.18-33.1
python-base-debugsource - addressed in versions 2.7.18-28.74.2, 2.7.18-33.1
python-devel - addressed in versions 2.7.18-28.74.2, 2.7.18-33.1
libpython2_7-1_0 - addressed in versions 2.7.18-28.74.2, 2.7.18-33.1
libpython2_7-1_0-debuginfo - addressed in versions 2.7.18-28.74.2, 2.7.18-33.1
python38-cryptography - update to 2.8-3
python38-psycopg2-tests - update to 2.8.4-4
python38-psycopg2-doc - update to 2.8.4-4
python38-psycopg2 - update to 2.8.4-4
python38-idna - update to 2.8-6
python38-jinja2 - update to 2.10.3-5
python38-pycparser - update to 2.19-3
python38-requests - update to 2.22.0-9
python38-chardet - update to 3.0.4-19
PowerStore T - update to 3.2.1.0-1989710
PowerStore X - update to 3.2.1.0-1989710
python3-base-debuginfo-32bit - update to 3.4.10-25.80.2
libpython3_4m1_0-debuginfo-32bit - update to 3.4.10-25.80.2
libpython3_4m1_0-32bit - update to 3.4.10-25.80.2
python3-tk - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.4, 3.6.15-10.9.1
python3-tk-debuginfo - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.4, 3.6.15-10.9.1
python3-curses-debuginfo - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.4, 3.6.15-10.9.1
python3-base-debuginfo - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.3, 3.6.15-10.9.1
python3-base-debugsource - update to 3.4.10-25.80.2
python3-dbm - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.4, 3.6.15-10.9.1
python3-dbm-debuginfo - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.4, 3.6.15-10.9.1
python3-debuginfo - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.4, 3.6.15-10.9.1
python3-debugsource - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.4, 3.6.15-10.9.1
python3-devel - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.3, 3.6.15-10.9.1
python3-devel-debuginfo - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.3, 3.6.15-10.9.1
libpython3_4m1_0 - update to 3.4.10-25.80.2
libpython3_4m1_0-debuginfo - update to 3.4.10-25.80.2
python3 - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.4, 3.6.15-10.9.1
python3-base - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.3, 3.6.15-10.9.1
python3-curses - addressed in versions 3.4.10-25.80.2, 3.6.15-3.91.4, 3.6.15-10.9.1
python3.4-minimal (Ubuntu package) - update to 3.5.22ubuntu0~16.04.13+esm1
python3.4 (Ubuntu package) - update to 3.5.22ubuntu0~16.04.13+esm1
python3 (Red Hat package) - update to 3.6.8-39.el8_4
platform-python - update to 3.6.8-39.0.1
platform-python-debug - update to 3.6.8-39.0.1
platform-python-devel - update to 3.6.8-39.0.1
python3-idle - update to 3.6.8-39.0.1
python3-libs - update to 3.6.8-39.0.1
python3-test - update to 3.6.8-39.0.1
python3-tkinter - update to 3.6.8-39.0.1
libpython3.6-stdlib (Ubuntu package) - update to 3.6.9-1~18.04ubuntu1.6
libpython3_6m1_0-debuginfo - addressed in versions 3.6.15-3.91.3, 3.6.15-10.9.1, 3.6.15-11.1
libpython3_6m1_0 - addressed in versions 3.6.15-3.91.3, 3.6.15-10.9.1, 3.6.15-11.1
python3-testsuite - update to 3.6.15-3.91.3
python3-tools - addressed in versions 3.6.15-3.91.3, 3.6.15-10.9.1
python3-core-debugsource - addressed in versions 3.6.15-3.91.3, 3.6.15-10.9.1
python3-idle - addressed in versions 3.6.15-3.91.4, 3.6.15-10.9.1
python36 - update to 3.6.15-11.1
python36-base - update to 3.6.15-11.1
python36-base-debuginfo - update to 3.6.15-11.1
python36-debuginfo - update to 3.6.15-11.1
python36-debugsource - update to 3.6.15-11.1
OpenManage Network Integration (OMNI) - update to 3.7
libpython3.7-stdlib (Ubuntu package) - update to 3.7.5-2ubuntu1~18.04.2
python3 - update to 3.7.9-15
python3-devel - update to 3.7.9-15
python3-debug - update to 3.7.9-15
python3-help - update to 3.7.9-15
python3-debuginfo - update to 3.7.9-15
python3-debugsource - update to 3.7.9-15
libpython3.8-stdlib (Ubuntu package) - update to 3.8.0-3ubuntu1~18.04.2
python38-rpm-macros - update to 3.8.12-1.0.1
python38-debug - update to 3.8.12-1.0.1
python38 - update to 3.8.12-1.0.1
python38-devel - update to 3.8.12-1.0.1
python38-idle - update to 3.8.12-1.0.1
python38-tkinter - update to 3.8.12-1.0.1
python38-test - update to 3.8.12-1.0.1
python38-libs - update to 3.8.12-1.0.1
mingw-python3 - update to 3.9.4-3.fc34
python39-testsuite - update to 3.9.10-150300.4.8.1
python39-doc - update to 3.9.10-150300.4.8.1
python39-doc-devhelp - update to 3.9.10-150300.4.8.1
python39-devel - update to 3.9.10-150300.4.8.1
python39-core-debugsource - update to 3.9.10-150300.4.8.1
python39-base-debuginfo - update to 3.9.10-150300.4.8.1
python39-base - update to 3.9.10-150300.4.8.1
libpython3_9-1_0-debuginfo - update to 3.9.10-150300.4.8.1
libpython3_9-1_0 - update to 3.9.10-150300.4.8.1
python39-base-32bit-debuginfo - update to 3.9.10-150300.4.8.1
python39-tools - update to 3.9.10-150300.4.8.1
libpython3_9-1_0-32bit - update to 3.9.10-150300.4.8.1
python39-testsuite-debuginfo - update to 3.9.10-150300.4.8.1
libpython3_9-1_0-32bit-debuginfo - update to 3.9.10-150300.4.8.1
python39-base-32bit - update to 3.9.10-150300.4.8.1
python39-debugsource - update to 3.9.10-150300.4.8.2
python39 - update to 3.9.10-150300.4.8.2
python39-curses - update to 3.9.10-150300.4.8.2
python39-curses-debuginfo - update to 3.9.10-150300.4.8.2
python39-dbm - update to 3.9.10-150300.4.8.2
python39-32bit-debuginfo - update to 3.9.10-150300.4.8.2
python39-dbm-debuginfo - update to 3.9.10-150300.4.8.2
python39-debuginfo - update to 3.9.10-150300.4.8.2
python39-32bit - update to 3.9.10-150300.4.8.2
python39-idle - update to 3.9.10-150300.4.8.2
python39-tk-debuginfo - update to 3.9.10-150300.4.8.2
python39-tk - update to 3.9.10-150300.4.8.2
IBM Cloud Transformation Advisor - update to 3.10.1
python3.10-minimal (Ubuntu package) - update to 3.10.12-1~22.04.4
python3.10 (Ubuntu package) - update to 3.10.12-1~22.04.4
python38-ply - update to 3.11-10
python3.12-minimal (Ubuntu package) - update to 3.12.0-1ubuntu0.1
python3.12 (Ubuntu package) - update to 3.12.0-1ubuntu0.1
Enterprise SONiC - update to 4.1.2
python38-lxml - update to 4.4.1-7
Dell Enterprise SONiC Distribution - update to 4.4.2
python38-pytest - update to 4.6.6-3
python38-mod_wsgi - update to 4.6.8-3
Dell EMC Unity Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity XT Operating Environment (OE) - update to 5.2.0.0.5.173
Dell EMC Unity VSA Operating Environment (OE) - update to 5.2.0.0.5.173
python38-pyyaml - update to 5.4.1-1
python38-psutil - update to 5.6.4-4
python38-more-itertools - update to 7.2.0-5
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
IBM Cognos Analytics - addressed in versions 11.1.7.6, 11.2.3
python38-packaging - update to 19.2-3
python38-attrs - update to 19.3.0-3
python38-pip-wheel - update to 19.3.1-5
python38-pip - update to 19.3.1-5
Junos Space Security Director - update to 24.1R3
python38-setuptools - update to 41.6.0-5
python38-setuptools-wheel - update to 41.6.0-5
python38-pytz - update to 2019.3-3

• https://bugzilla.redhat.com/show_bug.cgi?id=1995234

• Multiple vulnerabilities in Red Hat OpenShift Virtualization
• Multiple vulnerabilities in Cloud Foundry cflinuxfs3
• Red Hat Software Collections update for python27-python and python27-python-pip
• Red Hat Enterprise Linux 8 update for the python38:3.8 and python38-devel:3.8 modules
• Red Hat Enterprise Linux 8 update for the python27:2.7 module
• Amazon Linux AMI update for python27
• SUSE update for python3
• SUSE update for python36
• SUSE update for python
• SUSE update for python
• SUSE update for python3
• SUSE update for python3
• SUSE update for python3
• Ubuntu update for python3.4
• Ubuntu update for python3.7
• Ubuntu update for python3.6
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• Multiple vulnerabilities in IBM Sterling Control Center
• Multiple vulnerabilities in IBM Cognos Analytics
• Red Hat Enterprise Linux 8 update for python3
• SUSE update for python39
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Resource management error in IBM Tivoli Application Dependency Discovery Manager
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Dell Unity, Dell UnityVSA, and Dell Unity XT
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in Dell EMC Enterprise SONiC
• openEuler update for python3
• Ubuntu update for python3.10
• Red Hat Enterprise Linux 8 update for the python39:3.9 and python39-devel:3.9 modules
• Multiple vulnerabilities in Red Hat OpenShift Serverless 1.19
• Fedora 36 update for python2.7
• Fedora 34 update for python2.7
• Fedora 33 update for python2.7
• Fedora 35 update for python2.7
• Fedora 34 update for mingw-python3
• Multiple vulnerabilities in Dell OpenManage Network Integration (OMNI)
• Anolis OS update for python3
• Anolis OS update for python38:3.8 module
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Dell Enterprise SONiC Distribution
• Multiple vulnerabilities in Junos Space Security Director Policy Enforcer module
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.2