Test Kennung:	1.3.6.1.4.1.25623.1.0.113639
Kategorie:	Denial of Service
Titel:	Python 2.7.x <= 2.7.17, 3.5 <= 3.5.9, 3.6.x <= 3.6.10, 3.7.x <= 3.7.6, 3.8.x <= 3.8.1 Regular Expression Denial of Service (ReDoS) Vulnerability (Mac OS X)
Zusammenfassung:	Python is prone to a Regular Expresson Denial of Service; (ReDoS) vulnerability.
Beschreibung:	Summary: Python is prone to a Regular Expresson Denial of Service (ReDoS) vulnerability. Vulnerability Insight: The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression (catastrophic backtracking) which can be exploited by an attacker to cause a denial of service. Vulnerability Impact: Successful exploitation would allow an attacker to crash the application. Affected Software/OS: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1. Solution: Update to version 3.5.10, 3.6.11, 3.7.8, 3.8.3 or 3.9.0 respectively. CVSS Score: 7.1 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2020-8492 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/ https://security.gentoo.org/glsa/202005-09 https://bugs.python.org/issue39503 https://github.com/python/cpython/pull/18284 https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5@%3Ccommits.cassandra.apache.org%3E https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da@%3Ccommits.cassandra.apache.org%3E https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html SuSE Security Announcement: openSUSE-SU-2020:0274 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html https://usn.ubuntu.com/4333-1/ https://usn.ubuntu.com/4333-2/
Copyright	Copyright (C) 2020 Greenbone Networks GmbH

Dies ist nur einer von 99761 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.