CVE-2021-28861

Published: 23 August 2022

** DISPUTED ** Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

Notes

Author	Note
	Priority reason: Works as documented, and disputed as being a security issue
mdeslaur	This CVE has now been disputed by the upstream developers, marking remaining releases as not-affected

Priority

Cvss 3 Severity Score

7.4

Score breakdown

Status

Package	Release	Status
python2.7 Launchpad, Ubuntu, Debian	bionic	Not vulnerable (code not present)
	focal	Not vulnerable (code not present)
	jammy	Not vulnerable (code not present)
	kinetic	Not vulnerable (code not present)
	lunar	Does not exist
	mantic	Does not exist
	trusty	Not vulnerable (code not present)
	upstream	Not vulnerable (code not present)
	xenial	Not vulnerable (code not present)
python3.10 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Released (3.10.6-1~22.04.1)
	kinetic	Not vulnerable (3.10.7-1)
	lunar	Does not exist
	mantic	Does not exist
	trusty	Does not exist
	upstream	Released (3.10.6)
	xenial	Does not exist
	Patches: upstream: https://github.com/python/cpython/commit/5715382d3a89ca118ce2e224d8c69550d21fe51b
python3.11 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Not vulnerable (3.11.0~rc1-1~22.04)
	kinetic	Not vulnerable (3.11.0~rc2-1)
	lunar	Not vulnerable (3.11.2-6)
	mantic	Not vulnerable (3.11.2-6)
	trusty	Does not exist
	upstream	Released (3.11.0)
	xenial	Does not exist
python3.4 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	trusty	Not vulnerable (disputed)
	upstream	Needs triage
	xenial	Does not exist
python3.5 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	trusty	Not vulnerable (disputed)
	upstream	Needs triage
	xenial	Released (3.5.2-2ubuntu0~16.04.13+esm5) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
python3.6 Launchpad, Ubuntu, Debian	bionic	Not vulnerable (disputed)
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
python3.7 Launchpad, Ubuntu, Debian	bionic	Not vulnerable (disputed)
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	Patches: upstream: https://github.com/python/cpython/commit/8a34afd55258c721e446d6de4a70353c39a24148
python3.8 Launchpad, Ubuntu, Debian	bionic	Not vulnerable (disputed)
	focal	Not vulnerable (disputed)
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
python3.9 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Released (3.9.5-3ubuntu0~20.04.1+esm1) Available with Ubuntu Pro
	jammy	Does not exist
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	Patches: upstream: https://github.com/python/cpython/commit/defaa2b19a9a01c79c1d5641a8aa179bb10ead3f

Severity score breakdown

Parameter	Value
Base score	7.4
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Changed
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›