huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2021-32399: kernel: race condition for removal of the HCI controller
Component: kernel
Severity: Important
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-05-11T00:00:00+00:00

A flaw was found in the Linux kernel’s handling of the removal of Bluetooth HCI controllers. This flaw allows an attacker with a local account to exploit a race condition, leading to corrupted memory and possible privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.13
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: e2cb6b891ad2b8caa9131e3be70f45243df82a80
CVE-2021-32610: php-pear: Directory traversal vulnerability
Component: php-pear
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2021-07-30T00:00:00+00:00

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.


Affected upstream versions: n/a
Fixed upstream versions: 1.4.14
Upstream repository: https://github.com/pear/Archive_Tar
Upstream fix commit: b5832439b1f37331fb4f87e67fe4f
CVE-2021-32626: redis: Lua scripts can overflow the heap-based Lua stack
Component: redis
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-10-04T00:00:00+00:00

A heap buffer overflow was found in redis. Specially crafted Lua scripts executing in Redis cause the heap-based Lua stack to overflow due to incomplete checks for this condition. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: >= 6.2.0, < 6.2.6, >= 6.0.0, < 6.0.16, >= 2.6.0, < 5.0.14
Fixed upstream versions: 6.0.16
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 666ed7facf4524bf6d19b11b20faa2cf93fdf591
CVE-2021-32627: redis: Integer overflow issue with Streams
Component: redis
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-10-04T00:00:00+00:00

An integer overflow issue was found in redis. The vulnerability involves changing the default "proto-max-bulk-len" and "client-query-buffer-limit" configuration parameters to very large values and constructing specially crafted large stream elements. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: >= 5.0.0, < 5.0.14, >= 6.0.0, < 6.0.16, >= 6.2.0, < 6.2.6
Fixed upstream versions: 6.0.16
Upstream repository: https://github.com/redis/redis
Upstream fix commit: f6a40570fa63d5afdd596c78083d754081d80ae3
CVE-2021-32628: redis: Integer overflow bug in the ziplist data structure
Component: redis
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-10-04T00:00:00+00:00

An integer overflow issue was found in the redis ziplist data structure. The vulnerability involves modifying the default ziplist configuration parameters (hash-max-ziplist-entries, hash-max-ziplist-value, zset-max-ziplist-entries or zset-max-ziplist-value) to a very large value, and then constructing specially crafted commands to create very large ziplists. This flaw allows a remote attacker to corrupt the heap and potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: >= 6.2.0, < 6.2.6, >= 6.0.0, < 6.0.16, < 5.0.14
Fixed upstream versions: 6.0.16
Upstream repository: https://github.com/redis/redis
Upstream fix commit: f6a40570fa63d5afdd596c78083d754081d80ae3
CVE-2021-32672: redis: Out of bounds read in lua debugger protocol parser
Component: redis
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2021-10-04T00:00:00+00:00

A flaw was found in redis. When using the Redis Lua Debugger, users can send malformed requests that cause the debugger’s protocol parser to read data beyond the actual buffer, potentially leading to an information disclosure.


Affected upstream versions: >= 3.2.0, < 5.0.14, >= 6.0.0, < 6.0.16, >= 6.0.0, < 6.2.6
Fixed upstream versions: 6.0.16
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 6ac3c0b7abd35f37201ed2d6298ecef4ea1ae1dd
CVE-2021-32675: redis: Denial of service via Redis Standard Protocol (RESP) request
Component: redis
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-10-04T00:00:00+00:00

A flaw was found in redis. When parsing an incoming Redis Standard Protocol (RESP) request, redis allocates memory according to user-specified values, which determine the number of elements (in the multi-bulk header) and size of each element (in the bulk header). This flaw allows an unauthenticated, remote user delivering specially crafted requests over multiple connections to cause the server to allocate a significant amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.


Affected upstream versions: < 5.0.14, >= 6.0.0, < 6.0.16, >= 6.2.0, < 6.2.6
Fixed upstream versions: 6.0.16
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 5674b0057ff2903d43eaff802017eddf37c360f8
CVE-2021-32687: redis: Integer overflow issue with intsets
Component: redis
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-10-04T00:00:00+00:00

An integer overflow issue was found in redis. The vulnerability involves changing the default "set-max-intset-entries" configuration parameter to a very large value and constructing specially crafted commands to manipulate sets. This flaw allows a remote attacker to leak arbitrary contents of the heap or potentially trigger remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Affected upstream versions: < 5.0.14, >= 6.0.0, < 6.0.16, >= 6.2.0, < 6.2.6
Fixed upstream versions: 6.0.16
Upstream repository: https://github.com/redis/redis
Upstream fix commit: a30d367a71b7017581cf1ca104242a3c644dec0f
CVE-2021-32740: rubygem-addressable: ReDoS in templates
Component: rubygem-addressable
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-07-03T00:00:00+00:00

A resource-consumption vulnerability was found in rubygem addressable, where its URI template implementation could allow an attacker's crafted template to consume resources, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

Statement: Red Hat CloudForms 5.0 (CFME 5.11) is in the maintenance support phase and we are no longer fixing Moderate/Low severity security bugs. Reference: https://access.redhat.com/support/policy/updates/cloudforms

OpenShift 3.11 components are currently in maintenance support phase, hence Moderate/Low severity security bugs are set as Out Of Support Scope (OOSS). Reference: https://access.redhat.com/support/policy/updates/openshift_noncurrent

Affected upstream versions: > 2.3.0, <= 2.7.0
Fixed upstream versions: addressable-2.8.0
Upstream repository: https://github.com/sporkmonger/addressable
Upstream fix commit: 0d8a3127e35886ce9284810a7f2438bff6b43cbc
CVE-2021-32786: mod_auth_openidc: open redirect in oidc_validate_redirect_url()
Component: mod_auth_openidc
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2021-07-22T00:00:00+00:00

A flaw was found in mod_auth_openidc where it does not sanitize redirection URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.


Affected upstream versions: < 2.4.9
Fixed upstream versions: v2.4.9
Upstream repository: https://github.com/zmartzone/mod_auth_openidc
Upstream fix commit: 3a115484eb927bc6daa5737dd84f88ff4bbc5544
CVE-2021-32791: mod_auth_openidc: hardcoded static IV and AAD with a reused key in AES GCM encryption
Component: mod_auth_openidc
Severity: Moderate
CWE: CWE-330 (Use of Insufficiently Random Values)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2021-07-24T00:00:00+00:00

A flaw was found in mod_auth_openidc. The AES GCM encryption uses a static IV and AAD which could lead to other cryptographic attacks. The highest threat from this liability is to data confidentiality.


Affected upstream versions: < 2.4.9
Fixed upstream versions: v2.4.9
Upstream repository: https://github.com/zmartzone/mod_auth_openidc
Upstream fix commit: 375407c16c61a70b56fdbe13b0d2c8f11398e92c
CVE-2021-32792: mod_auth_openidc: XSS when using OIDCPreservePost On
Component: mod_auth_openidc
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Public date: 2021-07-24T00:00:00+00:00

A flaw was found in mod_auth_openidc. When mod_auth_openidc is configured with `OIDCPreservePost On` it is possible to trigger a cross site scripting(XSS) vulnerability that could be used by a remote attacker to execute code on the browser of the victim user. The highest threat from this flaw is to data confidentiality and integrity.

Statement: This issue did not affect the versions of mod_auth_openidc as shipped with Red Hat Enterprise Linux 7 as they did not include support for OIDCPreservePost option.

Affected upstream versions: < 2.4.9
Fixed upstream versions: v2.4.9
Upstream repository: https://github.com/zmartzone/mod_auth_openidc
Upstream fix commit: 00c315cb0c8ab77c67be4a2ac08a71a83ac58751
CVE-2021-32803: nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite
Component: nodejs-tar
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
Public date: 2021-08-03T00:00:00+00:00

The npm package "tar" (aka node-tar) has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created.

Statement: Red Hat Quay 3.3 uses an affected version of nodejs-tar. However Quay 3.3 is in extended life phase and a fix will not be delivered[1]. More recent versions of Red Hat Quay do not include nodejs-tar and are not affected.

1. https://access.redhat.com/support/policy/updates/rhquay

Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed node-tar in the npm command. However, npm explicitly prevents the extraction of symlink via a filter. npm might still be affected via node-gyp, if the attacker is able to control the target URL.

Affected upstream versions: < 3.2.3, >= 4.0.0, < 4.4.15, >= 5.0.0, < 5.0.7, >= 6.0.0, < 6.1.2
Fixed upstream versions: v6.1.2
Upstream repository: https://github.com/npm/node-tar
Upstream fix commit: 9dbdeb6df8e9dbd96fa9e84341b9d74734be6c20
CVE-2021-32804: nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite
Component: nodejs-tar
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
Public date: 2021-08-03T00:00:00+00:00

The npm package "tar" (aka node-tar) has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file.

Statement: Red Hat Quay 3.3 uses an affected version of nodejs-tar. However Quay 3.3 is in extended life phase and a fix will not be delivered[1]. More recent versions of Red Hat Quay do not include nodejs-tar and are not affected.

1. https://access.redhat.com/support/policy/updates/rhquay

Red Hat Enterprise Linux version 8 and Red Hat Software Collection both embed node-tar in the npm command. A specially crafted node module could create and overwrite files outside of its dedicated directory.

Affected upstream versions: < 3.2.2, >= 4.0.0, < 4.4.14, >= 5.0.0, < 5.0.6, >= 6.0.0, < 6.1.1
Fixed upstream versions: v6.1.1
Upstream repository: https://github.com/npm/node-tar
Upstream fix commit: 1f036ca23f64a547bdd6c79c1a44bc62e8115da4
CVE-2021-32839: python-sqlparse: ReDoS via regular expression in StripComments filter
Component: python-sqlparse
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-09-10T00:00:00+00:00

A resource-consumption flaw was found in python-sqlparse. The formatter function that strips comments from SQL contains a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). A network attacker could craft an SQL comment containing numerous repetitions of '\r\n' that could cause exponential backtracking and cause the system to hang.


Affected upstream versions: >= 0.4.0, < 0.4.2
Fixed upstream versions: 0.4.2
Upstream repository: https://github.com/andialbrecht/sqlparse
Upstream fix commit: 8238a9e450ed1524e40cb3a8b0b3c00606903aeb
CVE-2021-33033: kernel: use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-03-04T00:00:00+00:00

A flaw use-after-free in the Linux kernel CIPSO network packet labeling protocol functionality was found in the way user open local network connection with the usage of the security labeling that is IP option number 134. A local user could use this flaw to crash the system or possibly escalate their privileges on the system.

Statement: Considered to be Moderate rate, because by default CIPSO non-enabled and both no known way to reproduce the attack remotely and both it looks complex if even possible to use the attack in any way apart from crashing the system. For the usage of the inbound CIPSO connections, the administrator have to enable it with netlabelctl utility first. The vulnerability is considered to be for local user, because it can happen only when a local user opens a socket for sending packets, but not during receiving packets.

Affected upstream versions: n/a
Fixed upstream versions: v5.12
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: ad5d07f4a9cd671233ae20983848874731102c08
CVE-2021-33034: kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-03-22T00:00:00+00:00

A use-after-free flaw was found in hci_send_acl in the bluetooth host controller interface (HCI) in Linux kernel, where a local attacker with an access rights could cause a denial of service problem on the system  The issue results from the object hchan, freed in hci_disconn_loglink_complete_evt, yet still used in other places. The highest threat from this vulnerability is to data integrity, confidentiality and system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 5c4c8c9544099bb9043a10a5318130a943e32fc3
CVE-2021-33193: httpd: Request splitting via HTTP/2 method injection and mod_proxy
Component: httpd
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2021-08-05T00:00:00+00:00

A NULL pointer dereference was found in Apache httpd mod_h2. The highest threat from this flaw is to system integrity.


Affected upstream versions: Apache HTTP Server 2.4 2.4.17 to 2.4.48
Fixed upstream versions: 2.4.49
Upstream repository: https://github.com/apache/httpd
Upstream fix commit: ecebcc035ccd8d0e2984fe41420d9e944f456b3c
CVE-2021-33194: golang: x/net/html: infinite loop in ParseFragment
Component: golang
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-05-20T00:00:00+00:00

A flaw was found in golang. An attacker can craft an input to ParseFragment within parse.go that would cause it to enter an infinite loop and never return. The greatest threat to the system is of availability.

Statement: Red Hat Developer Tools go-toolset-1.14-golang not affected because the vulnerable code is not shipped.

This vulnerability within golang and buildah shipped with RHEL-7 are out of support scope. For more information on Red Hat's support scope, visit: https://access.redhat.com/support/policy/updates/errata

For RHEL-8's go-toolset:rhel8/golang, container-tools:1.0/buildah, container-tools:2.0/buildah, and container-tools:rhel8/buildah, the affected function is only used in e2e tests.

For RHEL-9's golang and buildah, the affected function is only used in e2e tests.

Red Hat Openshift Container Storage has dependencies with the affected code, however, low priority trackers were filed as the vulnerable code is not shipped or used.

Affected upstream versions: n/a
Fixed upstream versions: v0.1.0
Upstream repository: https://github.com/golang/net
Upstream fix commit: 37e1c6afe02340126705deced573a85ab75209d7
CVE-2021-33200: kernel: out-of-bounds reads and writes due to enforcing incorrect limits for pointer arithmetic operations by BPF verifier
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-05-26T00:00:00+00:00

A flaw was found in kernel/bpf/verifier.c in BPF in the Linux kernel. An incorrect limit is enforced for pointer arithmetic operations which can be abused to perform out-of-bounds reads and writes in kernel memory, leading to local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.13
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
Upstream fix commit: 3d0220f6861d713213b015b582e9f21e5b28d2e0
CVE-2021-3326: glibc: Assertion failure in ISO-2022-JP-3 gconv module related to combining characters
Component: glibc
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-01-27T00:00:00+00:00

A flaw was found in glibc's iconv() functionality. This flaw allows an attacker capable of supplying a crafted sequence of characters to an application using iconv() to convert from ISO-2022-JP-3 to cause an assertion failure. The highest threat from this vulnerability is to system availability.

Statement: Exploitation of this flaw would cause the application to halt execution. It relies on processing untrusted input in the ISO-2022-JP-3 encoding or ISO-2022-JP-3 being used as a MIME charset in applications using iconv.

Affected upstream versions: n/a
Fixed upstream versions: glibc-2.33
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 7d88c6142c6efc160c0ee5e4f85cde382c072888
CVE-2021-3347: kernel: Use after free via PI futex state
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-01-28T00:00:00+00:00

A flaw was found in the Linux kernel. A use-after-free memory flaw in the Fast Userspace Mutexes functionality allowing a local user to crash the system or escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Affected upstream versions: n/a
Fixed upstream versions: v5.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c64396cc36c6e60704ab06c1fb1c4a46179c9120
CVE-2021-3348: kernel: Use-after-free in ndb_queue_rq() in drivers/block/nbd.c
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2021-01-28T00:00:00+00:00

A use after free flaw in the Linux kernel network block device (NBD) subsystem was found in the way user calls an ioctl NBD_SET_SOCK at a certain point during device setup.

Statement: This flaw is rated as having a Moderate impact because in the default configuration, the issue can only be triggered by a privileged local user (with access to the nbd device).

Affected upstream versions: n/a
Fixed upstream versions: v5.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b98e762e3d71e893b221f871825dc64694cfb258
CVE-2021-33503: python-urllib3: ReDoS in the parsing of authority part of URL
Component: python-urllib3
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2021-06-01T00:00:00+00:00

A flaw was found in python-urllib3. When provided with a URL containing many @ characters in the authority component, the authority's regular expression exhibits catastrophic backtracking. This flaw causes a denial of service if a URL is passed as a parameter or redirected via an HTTP redirect. The highest threat from this vulnerability is to system availability.

Statement: * Red Hat OpenShift Container Platform (OCP) 4 delivers the python-urllib3 package which includes a vulnerable version of urllib3 module, however from OCP 4.6 the python-urllib3 package is no longer shipped. OCP 4.5 is out of support scope for Moderate and Low impact vulnerabilities, hence is marked Out Of Support Scope.
The python-urllib3 package used in OCP 3.11 is not affected by this flaw.

Affected upstream versions: n/a
Fixed upstream versions: 1.26.5
Upstream repository: https://github.com/urllib3/urllib3
Upstream fix commit: 2d4a3fee6de2fa45eb82169361918f759269b4ec