jvndb-2021-001756
Vulnerability from jvndb
Published
2021-06-08 12:21
Modified
2021-06-08 12:21
Severity
Summary
urllib3 vulnerable to Regular expression Denial-of-Service (ReDoS)
Details
urllib3 contains a Regular expression Denial-of-Service (DoS) vulnerability.
urllib3, an HTTP client module for Python, contains a Regular expression Denial-of-Service (ReDoS) vulnerability (CWE-400, CVE-2021-33503) due to catastrophic backtracking while processing a malicious URL.
Nariyoshi Chida of NTT Secure Platform Laboratories reported this vulnerability to urllib3 community and coordinated. JPCERT/CC published this advisory in order to notify users of this vulnerability.
References
| Type | URL |
|---|---|
| JVN | https://jvn.jp/en/vu/JVNVU92413403/ |
| CVE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503 |
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2021-33503 |
| Uncontrolled Resource Consumption ('Resource Exhaustion')(CWE-400) | https://cwe.mitre.org/data/definitions/400.html |
Impacted products
| Vendor | Product |
|---|---|
| Python Software Foundation | urllib3 |
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-001756.html",
"dc:date": "2021-06-08T12:21+09:00",
"dcterms:issued": "2021-06-08T12:21+09:00",
"dcterms:modified": "2021-06-08T12:21+09:00",
"description": "urllib3 contains a Regular expression Denial-of-Service (DoS) vulnerability.\r\n\r\nurllib3, an HTTP client module for Python, contains a Regular expression Denial-of-Service (ReDoS) vulnerability (CWE-400, CVE-2021-33503) due to catastrophic backtracking while processing a malicious URL.\r\n\r\nNariyoshi Chida of NTT Secure Platform Laboratories reported this vulnerability to urllib3 community and coordinated. JPCERT/CC published this advisory in order to notify users of this vulnerability.",
"link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-001756.html",
"sec:cpe": {
"#text": "cpe:/a:python:urllib3",
"@product": "urllib3",
"@vendor": "Python Software Foundation",
"@version": "2.2"
},
"sec:cvss": [
{
"@score": "5.0",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"@version": "2.0"
},
{
"@score": "5.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2021-001756",
"sec:references": [
{
"#text": "https://jvn.jp/en/vu/JVNVU92413403/",
"@id": "JVNVU#92413403",
"@source": "JVN"
},
{
"#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503",
"@id": "CVE-2021-33503",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-33503",
"@id": "CVE-2021-33503",
"@source": "NVD"
},
{
"#text": "https://cwe.mitre.org/data/definitions/400.html",
"@id": "CWE-400",
"@title": "Uncontrolled Resource Consumption (\u0027Resource Exhaustion\u0027)(CWE-400)"
}
],
"title": "urllib3 vulnerable to Regular expression Denial-of-Service (ReDoS)"
}
Loading...