Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2020-8492 →
UBUNTU-CVE-2020-8492
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Ex...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Ubuntu:Pro:14.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8ubuntu0.6+esm5"}]}]
Ubuntu:Pro:14.04:LTS
python3.4
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.3-1ubuntu1~14.04.7+esm6"}]}]
Ubuntu:Pro:14.04:LTS
python3.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.4~14.04.1+esm1"}]}]
Ubuntu:16.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.12-1ubuntu0~16.04.11"}]}]
Ubuntu:16.04:LTS
python3.5
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.10"}]}]
Ubuntu:18.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1"}]}]
Ubuntu:18.04:LTS
python3.6
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.9-1~18.04ubuntu1"}]}]
Ubuntu:18.04:LTS
python3.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-2ubuntu1~18.04.2"}]}]
Ubuntu:18.04:LTS
python3.8
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-3ubuntu1~18.04.2"}]}]
Ubuntu:20.04:LTS
python2.7
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.1"}]}]
Ubuntu:20.04:LTS
python3.8
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-1ubuntu1.1"}]}]
Références
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- advisory ubuntu.com
- report ubuntu.com
- report github.com
- report python-security.readthedocs.io
- report github.com
- report cve.org