CVE-2021-28861

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

References

Affected packages

Git / github.com/python/cpython

Affected ranges

Type

GIT

Repo

https://github.com/python/cpython

Events

Introduced

Fixed

e1ebdc52b8bd82a928398b0a75149552a723389a

Introduced

fa919fdf2583bdfead1df00e842f24f30b2a34bf

Fixed

f43e7678a1443b2583fc9bfba091b8ca7e38f075

Introduced

9cf6752276e6fcfd0c23fdb064ad27f448aaaf75

Fixed

816066f497ab89abcdb3c4f2d34462c750d23713

Introduced

b494f5935c92951e75597bfe1c8b1f3112fec270

Fixed

9c7b4bd1646f2170247f88cf59936740d9c4c004

Database specific

{
    "versions": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.7.14"
        },
        {
            "introduced": "3.8.0"
        },
        {
            "fixed": "3.8.14"
        },
        {
            "introduced": "3.9.0"
        },
        {
            "fixed": "3.9.14"
        },
        {
            "introduced": "3.10.0"
        },
        {
            "fixed": "3.10.6"
        }
    ]
}

Affected versions

v3.*

v3.10.0

v3.10.1

v3.10.2

v3.10.3

v3.10.4

v3.10.5

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-28861.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11.0-alpha1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11.0-alpha2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11.0-alpha3"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11.0-alpha4"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11.0-alpha5"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11.0-alpha6"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11.0-alpha7"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11.0-beta1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11.0-beta2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "3.11.0-beta3"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "35"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "36"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "37"
            }
        ]
    }
]