CVE-2021-28861
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2021-28861
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-28861.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2021-28861
- Aliases
- Related
- Withdrawn
- 2023-05-03T00:00:00Z
- Published
- 2022-08-23T01:15:07Z
- Modified
- 2024-08-04T12:03:33.996419Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
- References
-
- https://bugs.python.org/issue43223
- https://security.gentoo.org/glsa/202305-02
- https://github.com/python/cpython/pull/24848
- https://github.com/python/cpython/pull/93879
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2TRINJE3INWDVIHIABW4L2NP3RUSK7BJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LTSPFIULY2GZJN3QYNFVM4JSU6H4D6J/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OABQ5CMPQETJLFHROAXDIDXCMDTNVYG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DISZAFSIQ7IAPAEQTC7G2Z5QUA2V2PSW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPX4XHT2FGVQYLY2STT2MRVENILNZTTU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I3MQT5ZE3QH5PVDJMERTBOCILHK35CBE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRGKPYA5YHIXQAMRIXO5DSCX7D4UUW4Q/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLE5INSVJUZJGY5OJXV6JREXWD7UDHYN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G66SRWUM36ENQ3X6LAIG7HAB27D4XJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZEPOPUFC42KXXSLFPZ47ZZRGPOR7SQE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X46T4EFTIBXZRYTGASBDEZGYJINH2OWV/
- https://security-tracker.debian.org/tracker/CVE-2021-28861
Affected packages
Debian:11 / pypy3
Package
- Name
- pypy3
- Purl
- pkg:deb/debian/pypy3?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Affected versions
7.*
7.3.5+dfsg-2
7.3.5+dfsg-2+deb11u1
7.3.5+dfsg-2+deb11u2
7.3.6~rc2+dfsg-1
7.3.6~rc2+dfsg-2
7.3.6+dfsg-1
7.3.7+dfsg-1
7.3.7+dfsg-2
7.3.7+dfsg-3
7.3.7+dfsg-4
7.3.7+dfsg-5
7.3.8~rc1+dfsg-1
7.3.8~rc1+dfsg-2
7.3.8+dfsg-1
7.3.8+dfsg-2
7.3.9+dfsg-1
7.3.9+dfsg-2
7.3.9+dfsg-3
7.3.9+dfsg-4
7.3.9+dfsg-5
7.3.10~rc3+dfsg-1
7.3.10~rc3+dfsg-2
7.3.10+dfsg-1
7.3.11+dfsg-1
7.3.11+dfsg-2
7.3.12~rc1+dfsg-1
7.3.12~rc2+dfsg-1
7.3.12+dfsg-1
7.3.13+dfsg-1
7.3.14+dfsg-1
7.3.15+dfsg-1
7.3.16+dfsg-1
7.3.16+dfsg-2
Debian:12 / pypy3
Package
- Name
- pypy3
- Purl
- pkg:deb/debian/pypy3?arch=source
Debian:13 / pypy3
Package
- Name
- pypy3
- Purl
- pkg:deb/debian/pypy3?arch=source
Debian:11 / python2.7
Package
- Name
- python2.7
- Purl
- pkg:deb/debian/python2.7?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected
Debian:12 / python3.11
Package
- Name
- python3.11
- Purl
- pkg:deb/debian/python3.11?arch=source
Debian:11 / python3.9
Package
- Name
- python3.9
- Purl
- pkg:deb/debian/python3.9?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affected