CVE-2021-3733: python +19 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-3733

CVSS 6.5 · Medium EPSS 4,7%

Kerentanan Uncontrolled Resource Consumption pada python, redhat codeready linux builder +18 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability.

Rincian

Terbit di NVD: 10 Maret 2022
Terakhir diubah: 14 Oktober 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-400: Uncontrolled Resource Consumption
EPSS (30 hari): 4,7% peluang dieksploitasi; lebih tinggi dari 91,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
python	python	Semua versi sebelum 3.6.14
python	python	Versi 3.7.0 hingga sebelum 3.7.11
python	python	Versi 3.8.0 hingga sebelum 3.8.10
python	python	Versi 3.9.0 hingga sebelum 3.9.5
python	python	Versi 3.10.0
redhat	codeready linux builder	Versi 8.0
redhat	codeready linux builder for ibm z systems	Versi 8.0
redhat	codeready linux builder for power little endian	Versi 8.0
redhat	enterprise linux	Versi 8.0
redhat	enterprise linux eus	Versi 8.4
redhat	enterprise linux for ibm z systems	Versi 8.0
redhat	enterprise linux for ibm z systems eus	Versi 8.4
redhat	enterprise linux for power little endian	Versi 8.0
redhat	enterprise linux for power little endian eus	Versi 8.4
redhat	enterprise linux server aus	Versi 8.4
redhat	enterprise linux server for power little endian update services for sap solutions	Versi 8.4
redhat	enterprise linux server tus	Versi 8.4
redhat	enterprise linux server update services for sap solutions	Versi 8.4
fedoraproject	extra packages for enterprise linux	Versi 7.0
fedoraproject	fedora	Versi 33
fedoraproject	fedora	Versi 34
fedoraproject	fedora	Versi 35
fedoraproject	fedora	Versi 36
netapp	management services for element software and netapp hci	Semua versi
netapp	ontap select deploy administration utility	Semua versi
netapp	solidfire, enterprise sds & hci storage node	Semua versi
netapp	hci compute node firmware	Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://bugs.python.org/issue43075 exploit · issue tracking · patch · advisory vendor
https://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb patch · advisory pihak ketiga
https://github.com/python/cpython/pull/24391 patch · advisory pihak ketiga
https://ubuntu.com/security/CVE-2021-3733 patch · advisory pihak ketiga
https://bugzilla.redhat.com/show_bug.cgi?id=1995234 issue tracking · advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20220407-0001/ advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 14 Okt 2026, 18:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.