CVE-2021-33503 Catastrophic backtracking in URL authority parser when passed URL containing many @ characters
Attackers can cause denial of service in urllib3 by providing URLs with many @ characters, triggering catastrophic backtracking in the authority parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-33503?
CVE-2021-33503 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 29 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
Weakness: CWE-400
Which versions are affected by CVE-2021-33503?
3 open source packages ship an affected version, including urllib3. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
urllib3 PyPI | From 1.25.4 | 1.26.5 |
urllib3 PyPI | From 1.25.4 | 1.26.5 |
urllib3 PyPI | From 1.25.4 | 1.26.5 |
Linux distribution packages (37)
automation-hub Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:4.2.6-1.el7pc |
python-galaxy-ng Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:4.2.6-1.el7pc |
python-urllib3 Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:1.26.5-1.el7pc |
python3-chardet Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:3.0.4-3.el7pc |
python3-click Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:7.1.2-3.el7pc |
python3-galaxy-ng Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:4.2.6-1.el7pc |
python3-gnupg Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:0.4.6-3.el7pc |
python3-jinja2 Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:2.11.2-3.el7pc |
python3-markupsafe Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:1.1.1-4.el7pc |
python3-markupsafe-debuginfo Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:1.1.1-4.el7pc |
python3-semantic-version Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:2.8.5-3.el7pc |
python3-urllib3 Red Hat:ansible_automation_platform:4.2::el7 | All versions | 0:1.26.5-1.el7pc |
automation-hub Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:4.2.6-1.el8pc |
python-galaxy-ng Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:4.2.6-1.el8pc |
python-urllib3 Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:1.26.5-1.el8pc |
python3-click Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:7.1.2-3.el8pc |
python3-galaxy-ng Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:4.2.6-1.el8pc |
python3-gnupg Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:0.4.6-3.el8pc |
python3-jinja2 Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:2.11.2-3.el8pc |
python3-markupsafe Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:1.1.1-4.el8pc |
python3-markupsafe-debuginfo Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:1.1.1-4.el8pc |
python3-markupsafe-debugsource Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:1.1.1-4.el8pc |
python3-semantic-version Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:2.8.5-3.el8pc |
python3-urllib3 Red Hat:ansible_automation_platform:4.2::el8 | All versions | 0:1.26.5-1.el8pc |
aws-cli SUSE:HPE Helion OpenStack 8 | All versions | 1.19.9-22.24.2 |
python-PyYAML SUSE:HPE Helion OpenStack 8 | All versions | 5.3.1-28.4.3 |
python-botocore SUSE:HPE Helion OpenStack 8 | All versions | 1.20.9-28.30.2 |
python-colorama SUSE:HPE Helion OpenStack 8 | All versions | 0.4.4-4.4.2 |
python-pexpect SUSE:HPE Helion OpenStack 8 | All versions | 4.3.1-3.9.2 |
python-ptyprocess SUSE:HPE Helion OpenStack 8 | All versions | 0.5.2-2.8.2 |
python-requests SUSE:HPE Helion OpenStack 8 | All versions | 2.24.0-3.3.1 |
python-six SUSE:HPE Helion OpenStack 8 | All versions | 1.14.0-13.10.3 |
python-urllib3 SUSE:HPE Helion OpenStack 8 | All versions | 1.25.10-3.29.1 |
python-urllib3 SUSE:HPE Helion OpenStack 8 | All versions | 1.25.10-5.19.1 |
python3-requests SUSE:HPE Helion OpenStack 8 | All versions | 2.24.0-8.14.3 |
python-pexpect SUSE:Linux Enterprise High Availability Extension 12 SP3 | All versions | 4.3.1-3.9.2 |
python-ptyprocess SUSE:Linux Enterprise High Availability Extension 12 SP3 | All versions | 0.5.2-2.8.2 |
Products include Fedoraproject Fedora, Oracle Enterprise Manager Ops Center, Oracle Instantis Enterprisetrack, Oracle Zfs Storage Appliance Kit, Python Urllib3.
How do I fix CVE-2021-33503?
Upgrade urllib3 to 1.26.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-33503 being exploited?
There is no known exploitation of CVE-2021-33503 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as AZL-6821, DEBIAN-CVE-2021-33503, GHSA-q2q7-5pp4-w6pg, MINI-r83f-v2rq-2cj6, OESA-2021-1260, PYSEC-2021-108 and 8 more.