Catastrophic backtracking in URL authority parser when passed URL containing many @ characters

CAO 7.5CVE-2021-33503 · GHSA-q2q7-5pp4-w6pg · PYSEC-2021-108 · Công bố 29/06/2021 · cập nhật 17/06/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
urllib3 PyPI	`≥ 1.25.4, < 1.26.5`	`1.26.5`
enterprise manager ops center oracle	`= 12.4.0.0`	Chưa có bản vá
instantis enterprisetrack oracle	`= 17.1= 17.2= 17.3`	Chưa có bản vá
zfs storage appliance kit oracle	`= 8.8`	Chưa có bản vá
urllib3 python	`≥ 1.25.4, < 1.26.5`	`1.26.5`

Mô tả

Impact

When provided with a URL containing many @ characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Patches

The issue has been fixed in urllib3 v1.26.5.

References

For more information

If you have any questions or comments about this advisory:

Ask in our community Discord
Email [email protected]

Mô tả của NVD

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Tham khảo

urllib3/urllib3 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-33503 · ADVISORY
urllib3/urllib3 commit 2d4a3fe · WEB
urllib3/urllib3 commit 5b047b6 · WEB
GitHub Advisory GHSA-q2q7-5pp4-w6pg · ADVISORY
pypa/advisory-database · WEB
urllib3/urllib3 · PACKAGE
lists.fedoraproject.org/archives/list/[email protected]/message/6SCV7ZNAHS3E6PBFLJGENCDRDRWRZZ6W · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/FMUGWEAUYGGHTPPXT6YBD53WYXQGVV73 · WEB

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí