Attachment 213681 Details for Bug 245819 – change for vuxml to include cve-2020-8492

[patch] change for vuxml to include cve-2020-8492

cve-2020-8492-correct.diff (text/plain), 1.92 KB, created by rob2g2 on 2020-04-22 11:53:09 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: rob2g2

Created: 2020-04-22 11:53:09 UTC

Size: 1.92 KB

patch

obsolete

>--- vuln.xml	2020-04-22 13:30:37.892123000 +0200
>+++ vuln2.xml	2020-04-22 13:31:19.106626000 +0200
>@@ -58,6 +58,52 @@
>   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
> -->
> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
>+  <vuln vid="c5fb0702-847e-11ea-a283-b42e99a1b9c3">
>+    <topic>Regular Expression DoS attack against client</topic>
>+    <affects>
>+      <package>
>+	<name>python38</name>
>+	<range><ge>3.8.0</ge><lt>3.8.2</lt></range>
>+      </package>
>+      <package>
>+	<name>python37</name>
>+	<range><ge>3.7.0</ge><lt>3.7.7</lt></range>
>+      </package>
>+      <package>
>+	<name>python36</name>
>+	<range><ge>3.6.0</ge><lt>3.6.10</lt></range>
>+      </package>
>+      <package>
>+	<name>python35</name>
>+	<range><ge>3.5.0</ge><lt>3.5.9</lt></range>
>+      </package>
>+      <package>
>+	<name>python27</name>
>+	<range><ge>2.7.0</ge><lt>2.7.17_1</lt></range>
>+      </package>
>+    </affects>
>+    <description>
>+      <body xmlns="http://www.w3.org/1999/xhtml">
>+	<p>Ben Caller, Matt Schwager report:</p>
>+	<blockquote cite="https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html">
>+	  <p>Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6,
>+	  and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service
>+	  (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler
>+	  catastrophic backtracking</p>
>+	</blockquote>
>+      </body>
>+    </description>
>+    <references>
>+      <url>https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html</url>
>+      <url>https://nvd.nist.gov/vuln/detail/CVE-2020-8492</url>
>+      <cvename>CVE-2020-8492</cvename>
>+    </references>
>+    <dates>
>+      <discovery>2005-09-23</discovery>
>+      <entry>2005-09-29</entry>
>+    </dates>
>+  </vuln>
>+
>   <vuln vid="0f798bd6-8325-11ea-9a78-08002728f74c">
>     <topic>libntlm -- buffer overflow vulnerability</topic>
>     <affects>

Actions: View | Diff

Attachments on bug 245819: 213678 | 213679 | 213681