CVE-2021-33503

ADVISORY - github

Summary

Impact

When provided with a URL containing many @ characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

Patches

The issue has been fixed in urllib3 v1.26.5.

References

For more information

If you have any questions or comments about this advisory:

Ask in our community Discord
Email sethmichaellarson@gmail.com

EPSS Score⁠: 0.00863 (0.749)

Common Weakness Enumeration (CWE)

ADVISORY - nist

CWE-400⁠

Uncontrolled Resource Consumption

ADVISORY - github

CWE-400⁠

Uncontrolled Resource Consumption

ADVISORY - gitlab

CWE-1035⁠

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

CWE-400⁠

Uncontrolled Resource Consumption

CWE-937⁠

OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities

ADVISORY - redhat

CWE-835⁠

Loop with Unreachable Exit Condition ('Infinite Loop')

Impacted images

Advisories

NIST

CREATED

5 years ago

UPDATED

1 year ago

ADVISORY IDCVE-2021-33503⁠

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-400⁠

CVSS SCORE

7.5high

GitHub

CREATED

5 years ago

UPDATED

1 year ago

ADVISORY IDGHSA-q2q7-5pp4-w6pg⁠

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-400⁠

CVSS SCORE

8.7high

Debian

CREATED

5 years ago

UPDATED

27 days ago

ADVISORY IDCVE-2021-33503⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Ubuntu

CREATED

5 years ago

UPDATED

1 year ago

ADVISORY IDCVE-2021-33503⁠

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

7.5low

PypA

CREATED

5 years ago

UPDATED

5 years ago

ADVISORY ID

PYSEC-2021-108

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

GitLab

CREATED

5 years ago

UPDATED

1 year ago

ADVISORY ID

CVE-2021-33503

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-1035⁠CWE-400⁠CWE-937⁠

CVSS SCORE

7.5high

Alma

CREATED

4 years ago

UPDATED

4 years ago

ADVISORY IDALSA-2021:4160⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Alma

CREATED

4 years ago

UPDATED

4 years ago

ADVISORY IDALSA-2021:4162⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Amazon

CREATED

5 years ago

UPDATED

5 years ago

ADVISORY IDALAS2-2021-1688⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Red Hat

CREATED

5 years ago

UPDATED

2 months ago

ADVISORY IDCVE-2021-33503⁠

EXPLOITABILITY SCORE

3.9

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-835⁠

CVSS SCORE

7.5medium

Rocky

CREATED

4 years ago

UPDATED

1 year ago

ADVISORY IDRLSA-2021:4160⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Alow

Rocky

CREATED

4 years ago

UPDATED

1 year ago

ADVISORY IDRLSA-2021:4162⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Alow

Oracle

CREATED

4 years ago

UPDATED

4 years ago

ADVISORY IDELSA-2021-4160⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

Oracle

CREATED

4 years ago

UPDATED

4 years ago

ADVISORY IDELSA-2021-4162⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium