CVE-2021-3737: python +16 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-3737

CVSS 7.5 · High EPSS 11,6%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada python, redhat codeready linux builder +15 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

Rincian

Terbit di NVD: 4 Maret 2022
Terakhir diubah: 14 Oktober 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-400: Uncontrolled Resource Consumption
EPSS (30 hari): 11,6% peluang dieksploitasi; lebih tinggi dari 95,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
python	python	Versi 3.6.0 hingga sebelum 3.6.14
python	python	Versi 3.7.0 hingga sebelum 3.7.11
python	python	Versi 3.8.0 hingga sebelum 3.8.11
python	python	Versi 3.9.0 hingga sebelum 3.9.6
redhat	codeready linux builder	Versi 8.0
redhat	codeready linux builder for ibm z systems	Versi 8.0
redhat	codeready linux builder for power little endian	Versi 8.0
redhat	enterprise linux	Versi 6.0
redhat	enterprise linux	Versi 7.0
redhat	enterprise linux	Versi 8.0
redhat	enterprise linux for ibm z systems	Versi 8.0
redhat	enterprise linux for power little endian	Versi 8.0
fedoraproject	fedora	Versi 33
fedoraproject	fedora	Versi 34
canonical	ubuntu linux	Versi 14.04
canonical	ubuntu linux	Versi 16.04
canonical	ubuntu linux	Versi 18.04
canonical	ubuntu linux	Versi 20.04
canonical	ubuntu linux	Versi 21.04
netapp	hci	Semua versi
netapp	management services for element software	Semua versi
netapp	netapp xcp smb	Semua versi
netapp	ontap select deploy administration utility	Semua versi
netapp	xcp nfs	Semua versi
oracle	communications cloud native core binding support function	Versi 22.1.3
oracle	communications cloud native core network exposure function	Versi 22.1.1
oracle	communications cloud native core policy	Versi 22.2.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://bugs.python.org/issue44022 exploit · issue tracking · advisory vendor
https://bugzilla.redhat.com/show_bug.cgi?id=1995162 issue tracking · patch · advisory pihak ketiga
https://github.com/python/cpython/pull/25916 patch · advisory pihak ketiga
https://github.com/python/cpython/pull/26503 patch · advisory pihak ketiga
https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html patch · advisory pihak ketiga
https://ubuntu.com/security/CVE-2021-3737 patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20220407-0009/ advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html
https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 14 Okt 2026, 18:26 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.