| Package | Affected versions | Patched versions |
|---|---|---|
| urllib3 | ≥ 1.25.4, < 1.26.5 | 1.26.5 |
| enterprise manager ops center | = 12.4.0.0 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| zfs storage appliance kit | = 8.8 | |
| urllib3 | ≥ 1.25.4, < 1.26.5 | 1.26.5 |
When provided with a URL containing many @ characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
The issue has been fixed in urllib3 v1.26.5.
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free