Candidate: CVE-2021-33503
PublicDate: 2021-06-29 11:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503
 https://github.com/advisories/GHSA-q2q7-5pp4-w6pg
 https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec
Description:
 An issue was discovered in urllib3 before 1.26.5. When provided with a URL
 containing many @ characters in the authority component, the authority
 regular expression exhibits catastrophic backtracking, causing a denial of
 service if a URL were passed as a parameter or redirected to via an HTTP
 redirect.
Ubuntu-Description:
Notes:
 mdeslaur> the python-pip package bundles python-urllib3 binaries
 mdeslaur> when built. After updating python-urllib3, a no-change
 mdeslaur> rebuild of python-pip is required.
 sbeattie> python-pip 20.3.4-4 build in impish is built against
   python3-urllib3 1.26.5-1~exp1, and thus impish and newer is fixed.
 sbeattie> introduced in urllib3 in
   0aa3e24fcd75f1bb59ab159e9f8adb44055b2271 or newer
Mitigation:
Bugs:
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H [7.5 HIGH]

Patches_python-urllib3:
upstream_python-urllib3:
trusty_python-urllib3: ignored (reached end-of-life)
trusty/esm_python-urllib3: not-affected
xenial_python-urllib3: not-affected
esm-infra/xenial_python-urllib3: not-affected
bionic_python-urllib3: not-affected
focal_python-urllib3: needed
groovy_python-urllib3: ignored (reached end-of-life)
hirsute_python-urllib3: ignored (reached end-of-life)
impish_python-urllib3: not-affected (1.26.5-1~exp1)
jammy_python-urllib3: not-affected (1.26.5-1~exp1)
devel_python-urllib3: not-affected (1.26.5-1~exp1)

Patches_python-pip:
upstream_python-pip:
trusty_python-pip: ignored (reached end of life)
trusty/esm_python-pip: not-affected (embedded urllib3 not affected)
xenial_python-pip: not-affected (embedded urllib3 not affected)
bionic_python-pip: not-affected (embedded urllib3 not affected)
focal_python-pip: needed
groovy_python-pip: ignored (reached end-of-life)
hirsute_python-pip: ignored (reached end-of-life)
impish_python-pip: not-affected (20.3.4-4)
jammy_python-pip: not-affected (20.3.4-4)
devel_python-pip: not-affected (20.3.4-4)