Attachment 213678 Details for Bug 245819 – change for vuxml to include cve-2020-8492

change for vuxml to include cve-2020-8492

cve-2020-8492.diff (text/plain), 1.61 KB, created by rob2g2 on 2020-04-22 11:33:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: rob2g2

Created: 2020-04-22 11:33:54 UTC

Size: 1.61 KB

patch

obsolete

>61,106d60
><   <vuln vid="c5fb0702-847e-11ea-a283-b42e99a1b9c3">
><     <topic>Regular Expression DoS attack against client</topic>
><     <affects>
><       <package>
>< 	<name>python38</name>
>< 	<range><ge>3.8.0</ge><lt>3.8.2</lt></range>
><       </package>
><       <package>
>< 	<name>python37</name>
>< 	<range><ge>3.7.0</ge><lt>3.7.7</lt></range>
><       </package>
><       <package>
>< 	<name>python36</name>
>< 	<range><ge>3.6.0</ge><lt>3.6.10</lt></range>
><       </package>
><       <package>
>< 	<name>python35</name>
>< 	<range><ge>3.5.0</ge><lt>3.5.9</lt></range>
><       </package>
><       <package>
>< 	<name>python27</name>
>< 	<range><ge>2.7.0</ge><lt>2.7.17_1</lt></range>
><       </package>
><     </affects>
><     <description>
><       <body xmlns="http://www.w3.org/1999/xhtml">
>< 	<p>Ben Caller, Matt Schwager report:</p>
>< 	<blockquote cite="https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html">
>< 	  <p>Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6,
>< 	  and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service
>< 	  (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler
>< 	  catastrophic backtracking</p>
>< 	</blockquote>
><       </body>
><     </description>
><     <references>
><       <url>https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html</url>
><       <url>https://nvd.nist.gov/vuln/detail/CVE-2020-8492</url>
><       <cvename>CVE-2020-8492</cvename>
><     </references>
><     <dates>
><       <discovery>2005-09-23</discovery>
><       <entry>2005-09-29</entry>
><     </dates>
><   </vuln>
><

Actions: View

Attachments on bug 245819: 213678 | 213679 | 213681