Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-3737

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

Published

2022-03-04T19:15:08.730

Last Modified

2024-11-21T06:22:17.417

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: COMPLETE

Exploitability Score

8.6

Impact Score

6.9

Weaknesses

Type: Secondary
CWE-835
Type: Primary
CWE-400
CWE-835

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	python	python	< 3.6.14	Yes
Application	python	python	< 3.7.11	Yes
Application	python	python	< 3.8.11	Yes
Application	python	python	< 3.9.6	Yes
Application	redhat	codeready_linux_builder	8.0	Yes
Application	redhat	codeready_linux_builder_for_ibm_z_systems	8.0	Yes
Application	redhat	codeready_linux_builder_for_power_little_endian	8.0	Yes
Operating System	redhat	enterprise_linux	6.0	Yes
Operating System	redhat	enterprise_linux	7.0	Yes
Operating System	redhat	enterprise_linux	8.0	Yes
Operating System	redhat	enterprise_linux_for_ibm_z_systems	8.0	Yes
Operating System	redhat	enterprise_linux_for_power_little_endian	8.0	Yes
Operating System	fedoraproject	fedora	33	Yes
Operating System	fedoraproject	fedora	34	Yes
Operating System	canonical	ubuntu_linux	14.04	Yes
Operating System	canonical	ubuntu_linux	16.04	Yes
Operating System	canonical	ubuntu_linux	18.04	Yes
Operating System	canonical	ubuntu_linux	20.04	Yes
Operating System	canonical	ubuntu_linux	21.04	Yes
Application	netapp	hci	-	Yes
Application	netapp	management_services_for_element_software	-	Yes
Application	netapp	netapp_xcp_smb	-	Yes
Application	netapp	ontap_select_deploy_administration_utility	-	Yes
Application	netapp	xcp_nfs	-	Yes
Application	oracle	communications_cloud_native_core_binding_support_function	22.1.3	Yes
Application	oracle	communications_cloud_native_core_network_exposure_function	22.1.1	Yes
Application	oracle	communications_cloud_native_core_policy	22.2.0	Yes

References

https://bugs.python.org/issue44022 Exploit, Issue Tracking, Vendor Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=1995162 Issue Tracking, Patch, Third Party Advisory ([email protected])
https://github.com/python/cpython/pull/25916 Patch, Third Party Advisory ([email protected])
https://github.com/python/cpython/pull/26503 Patch, Third Party Advisory ([email protected])
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html ([email protected])
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html ([email protected])
https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html Patch, Third Party Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20220407-0009/ Third Party Advisory ([email protected])
https://ubuntu.com/security/CVE-2021-3737 Patch, Third Party Advisory ([email protected])
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory ([email protected])
https://bugs.python.org/issue44022 Exploit, Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=1995162 Issue Tracking, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/python/cpython/pull/25916 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/python/cpython/pull/26503 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html (af854a3a-2127-422b-91ae-364da2661108)
https://python-security.readthedocs.io/vuln/urllib-100-continue-loop.html Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20220407-0009/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://ubuntu.com/security/CVE-2021-3737 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)