VULNERABILITY INTELLIGENCE
CVE-2020-8492
CVSS score6.5 MEDIUM
EPSS probability6.62%
CISA KEVNot currently listed
Published2020-01-30
Last modified2026-10-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Description
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
Weakness classification
- nvd@nist.gov: CWE-400
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-400
Primary references
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Issue Tracking, Vendor Advisory
- cve@mitre.org — Patch, Third Party Advisory
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org — Mailing List, Third Party Advisory
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org
- cve@mitre.org — Exploit, Third Party Advisory