--- vuln2.xml 2020-04-22 13:31:19.106626000 +0200 +++ vuln.xml 2020-04-22 13:30:37.892123000 +0200 @@ -58,52 +58,6 @@ * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> - - Regular Expression DoS attack against client - - - python38 - 3.8.03.8.2 - - - python37 - 3.7.03.7.7 - - - python36 - 3.6.03.6.10 - - - python35 - 3.5.03.5.9 - - - python27 - 2.7.02.7.17_1 - - - - -

Ben Caller, Matt Schwager report:

-
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, - and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service - (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler - catastrophic backtracking
-

- - - - https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html - https://nvd.nist.gov/vuln/detail/CVE-2020-8492 - CVE-2020-8492 - - - 2005-09-23 - 2005-09-29 - - - libntlm -- buffer overflow vulnerability