This page tracks the Ubuntu fix status. The vulnerability itself is described on the main CVE page.
View CVE-2020-8492 →
UBUNTU-CVE-2020-8492
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Ex...
Original description
The description as published by the source.
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Ubuntu:Pro:14.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8ubuntu0.6+esm5"}]}]
Ubuntu:Pro:14.04:LTS
python3.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1ubuntu1~14.04.7+esm6"}]}]
Ubuntu:Pro:14.04:LTS
python3.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"}]}]
Ubuntu:16.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.12-1ubuntu0~16.04.11"}]}]
Ubuntu:16.04:LTS
python3.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.10"}]}]
Ubuntu:18.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1"}]}]
Ubuntu:18.04:LTS
python3.6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1"}]}]
Ubuntu:18.04:LTS
python3.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-2ubuntu1~18.04.2"}]}]
Ubuntu:18.04:LTS
python3.8
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-3ubuntu1~18.04.2"}]}]
Ubuntu:20.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.1"}]}]
Ubuntu:20.04:LTS
python3.8
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-1ubuntu1.1"}]}]
References
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- report ubuntu.com
- report github.com
- report python-security.readthedocs.io
- report github.com
- report cve.org