Attachment 213679 Details for Bug 245819 – change for vuxml to include cve-2020-8492

[patch] change for vuxml to include cve-2020-8492

cve-2020-8492.diff (text/plain), 1.92 KB, created by rob2g2 on 2020-04-22 11:42:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: rob2g2

Created: 2020-04-22 11:42:16 UTC

Size: 1.92 KB

patch

obsolete

>--- vuln2.xml	2020-04-22 13:31:19.106626000 +0200
>+++ vuln.xml	2020-04-22 13:30:37.892123000 +0200
>@@ -58,52 +58,6 @@
>   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>-  <vuln vid="c5fb0702-847e-11ea-a283-b42e99a1b9c3">
>-    <topic>Regular Expression DoS attack against client</topic>
>-    <affects>
>-      <package>
>-	<name>python38</name>
>-	<range><ge>3.8.0</ge><lt>3.8.2</lt></range>
>-      </package>
>-      <package>
>-	<name>python37</name>
>-	<range><ge>3.7.0</ge><lt>3.7.7</lt></range>
>-      </package>
>-      <package>
>-	<name>python36</name>
>-	<range><ge>3.6.0</ge><lt>3.6.10</lt></range>
>-      </package>
>-      <package>
>-	<name>python35</name>
>-	<range><ge>3.5.0</ge><lt>3.5.9</lt></range>
>-      </package>
>-      <package>
>-	<name>python27</name>
>-	<range><ge>2.7.0</ge><lt>2.7.17_1</lt></range>
>-      </package>
>-    </affects>
>-    <description>
>-      <body xmlns="http://www.w3.org/1999/xhtml">
>-	<p>Ben Caller, Matt Schwager report:</p>
>-	<blockquote cite="https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html">
>-	  <p>Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6,
>-	  and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service
>-	  (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler
>-	  catastrophic backtracking</p>
>-	</blockquote>
>-      </body>
>-    </description>
>-    <references>
>-      <url>https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html</url>
>-      <url>https://nvd.nist.gov/vuln/detail/CVE-2020-8492</url>
>-      <cvename>CVE-2020-8492</cvename>
>-    </references>
>-    <dates>
>-      <discovery>2005-09-23</discovery>
>-      <entry>2005-09-29</entry>
>-    </dates>
>-  </vuln>
>-
>   <vuln vid="0f798bd6-8325-11ea-9a78-08002728f74c">
>     <topic>libntlm -- buffer overflow vulnerability</topic>
>     <affects>

Actions: View | Diff

Attachments on bug 245819: 213678 | 213679 | 213681