CVE-2020-8492

Description

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

How to fix CVE-2020-8492

To remediate CVE-2020-8492, upgrade the affected package to a fixed version below.

• Alpine/python3—upgrade to 3.7.7-r0 or later
• —upgrade to 2.7.18 or later
• —upgrade to 2.7.18 or later
• —upgrade to 2.7.18 or later
• —upgrade to 2.7.18-2 or later

Is CVE-2020-8492 being exploited?

Low — EPSS is 3.0%, meaning exploitation activity has not been observed at scale.

Affected packages (5)

• from 0, < 3.7.7-r0
• >= 2.7.0, < 2.7.18, >= 3.5.0, < 3.5.10, >= 3.6.0, < 3.6.11, >= 3.7.0, < 3.7.7, >= 3.8.0, < 3.8.2
• >= 2.7.0, < 2.7.18, >= 3.5.0, < 3.5.10, >= 3.6.0, < 3.6.11, >= 3.7.0, < 3.7.7, >= 3.8.0, < 3.8.2
• >= 2.7.0, < 2.7.18, >= 3.5.0, < 3.5.10, >= 3.6.0, < 3.6.11, >= 3.7.0, < 3.7.7, >= 3.8.0, < 3.8.2
• from 0, < 2.7.18-2

CVSS scores

References (19)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2020-8492
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2020-8492
• WEBlists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html
• WEBbugs.python.org/issue39503
• WEB