--- vuln.xml 2020-04-22 13:30:37.892123000 +0200 +++ vuln2.xml 2020-04-22 13:31:19.106626000 +0200 @@ -58,6 +58,52 @@ * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + Regular Expression DoS attack against client + + + python38 + 3.8.03.8.2 + + + python37 + 3.7.03.7.7 + + + python36 + 3.6.03.6.10 + + + python35 + 3.5.03.5.9 + + + python27 + 2.7.02.7.17_1 + + + + +

Ben Caller, Matt Schwager report:

+
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, + and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service + (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler + catastrophic backtracking
+

+ + + + https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html + https://nvd.nist.gov/vuln/detail/CVE-2020-8492 + CVE-2020-8492 + + + 2005-09-23 + 2005-09-29 + + + libntlm -- buffer overflow vulnerability