CVE-2020-8492 Denial of service in n/a
A malicious HTTP server can cause a denial of service in Python clients via catastrophic backtracking in the urllib authentication handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-8492?
CVE-2020-8492 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 30 Jan 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
Weakness: CWE-400
Which versions are affected by CVE-2020-8492?
3 open source packages ship an affected version, including libpython, python and python-min. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | From 2.7.0 | 2.7.18, 3.5.10, 3.6.11, 3.7.7, 3.8.2 |
python Bitnami | From 2.7.0 | 2.7.18, 3.5.10, 3.6.11, 3.7.7, 3.8.2 |
python-min Bitnami | From 2.7.0 | 2.7.18, 3.5.10, 3.6.11, 3.7.7, 3.8.2 |
Linux distribution packages (6)
python SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 2.6.9-40.35.2 |
python-base SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 2.6.9-40.35.1 |
python-doc SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 2.6-8.40.35.1 |
python SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 2.6.9-40.35.2 |
python-base SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 2.6.9-40.35.1 |
python-doc SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 2.6-8.40.35.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Python Python.
How do I fix CVE-2020-8492?
Upgrade libpython to a fixed version for your release line: 2.7.18, 3.5.10, 3.6.11 or 3.7.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-8492 being exploited?
There is no known exploitation of CVE-2020-8492 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2020-8492, BIT-libpython-2020-8492, BIT-python-2020-8492, BIT-python-min-2020-8492, CLEANSTART-2026-LV14953, DEBIAN-CVE-2020-8492 and 4 more.