ID

VAR-202109-1966

CVE

CVE-2021-3733

TITLE

Python Resource Management Error Vulnerability

DESCRIPTION

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression Denial of Service (ReDOS) during an authentication request with a specially crafted payload that is sent by the server to the client. The greatest threat that this flaw poses is to application availability. Python is an open source, object-oriented programming language developed by the Python Foundation. The language is scalable, supports modules and packages, and supports multiple platforms. A code issue vulnerability exists in Python due to a failure in the product to properly handle RCFS. Description: Red Hat 3scale API Management delivers centralized API management features through a distributed, cloud-hosted layer. It includes built-in features to help in building a more successful API program, including access control, rate limits, payment gateway integration, and developer experience tools. This advisory is intended to use with Container Images, for Red Hat 3scale API Management 2.11.1. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/): 1912487 - CVE-2020-26247 rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema 5. JIRA issues fixed (https://issues.jboss.org/): THREESCALE-6868 - [3scale][2.11][LO-prio] Improve select default Application plan THREESCALE-6879 - [3scale][2.11][HI-prio] Add 'Create new Application' flow to Product > Applications index THREESCALE-7030 - Address scalability in 'Create new Application' form THREESCALE-7203 - Fix Zync resync command in 5.6.9. Creating equivalent Zync routes THREESCALE-7475 - Some api calls result in "Destroying user session" THREESCALE-7488 - Ability to add external Lua dependencies for custom policies THREESCALE-7573 - Enable proxy environment variables via the APICAST CRD THREESCALE-7605 - type change of "policies_config" in /admin/api/services/{service_id}/proxy.json THREESCALE-7633 - Signup form in developer portal is disabled for users authenticted via external SSO THREESCALE-7644 - Metrics: Service for 3scale operator is missing THREESCALE-7646 - Cleanup/refactor Products and Backends index logic THREESCALE-7648 - Remove "#context-menu" from the url THREESCALE-7704 - Images based on RHEL 7 should contain at least ca-certificates-2021.2.50-72.el7_9.noarch.rpm THREESCALE-7731 - Reenable operator metrics service for apicast-operator THREESCALE-7761 - 3scale Operator doesn't respect *_proxy env vars THREESCALE-7765 - Remove MessageBus from System THREESCALE-7834 - admin can't create application when developer is not allowed to pick a plan THREESCALE-7863 - Update some Obsolete API's in 3scale_v2.js THREESCALE-7884 - Service top application endpoint is not working properly THREESCALE-7912 - ServiceMonitor created by monitoring showing HTTP 400 error THREESCALE-7913 - ServiceMonitor for 3scale operator has wide selector 6. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL. Bugs fixed (https://bugzilla.redhat.com/): 1995162 - CVE-2021-3737 python: urllib: HTTP client possible infinite loop on a 100 Continue response 1995234 - CVE-2021-3733 python: urllib: Regular expression DoS in AbstractBasicAuthHandler 2006792 - RHEL 8 Python 2.7: pip contains bundled pre-built exe files in site-packages/pip/_vendor/distlib/ 2032569 - CVE-2021-43818 python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through 2036020 - CVE-2021-4189 python: ftplib should not use the host from the PASV response 2047376 - CVE-2022-0391 python: urllib.parse does not sanitize URLs containing ASCII newline and tabs 6. ========================================================================== Ubuntu Security Notice USN-5083-1 September 16, 2021 python3.4, python3.5 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: Several security issues were fixed in Python. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 ESM. (CVE-2021-3733) It was discovered that Python incorrectly handled certain server responses. An attacker could possibly use this issue to cause a denial of service. (CVE-2021-3737) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 ESM: python3.5 3.5.2-2ubuntu0~16.04.13+esm1 python3.5-minimal 3.5.2-2ubuntu0~16.04.13+esm1 Ubuntu 14.04 ESM: python3.4 3.4.3-1ubuntu1~14.04.7+esm11 python3.4-minimal 3.4.3-1ubuntu1~14.04.7+esm11 In general, a standard system update will make all the necessary changes. Bugs fixed (https://bugzilla.redhat.com/): 1948761 - CVE-2021-23369 nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option 1956688 - CVE-2021-23383 nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option 5. JIRA issues fixed (https://issues.jboss.org/): LOG-1858 - OpenShift Alerting Rules Style-Guide Compliance LOG-1917 - [release-5.1] Fluentd logs emit transaction failed: error_class=NoMethodError while forwarding to external syslog server 6. Description: Red Hat Advanced Cluster Management for Kubernetes 2.4.0 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_mana gement_for_kubernetes/2.4/html/release_notes/ Security fixes: * CVE-2021-33623: nodejs-trim-newlines: ReDoS in .end() method * CVE-2021-32626: redis: Lua scripts can overflow the heap-based Lua stack * CVE-2021-32627: redis: Integer overflow issue with Streams * CVE-2021-32628: redis: Integer overflow bug in the ziplist data structure * CVE-2021-32672: redis: Out of bounds read in lua debugger protocol parser * CVE-2021-32675: redis: Denial of service via Redis Standard Protocol (RESP) request * CVE-2021-32687: redis: Integer overflow issue with intsets * CVE-2021-32690: helm: information disclosure vulnerability * CVE-2021-32803: nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite * CVE-2021-32804: nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite * CVE-2021-23017: nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name * CVE-2021-3711: openssl: SM2 Decryption Buffer Overflow * CVE-2021-3712: openssl: Read buffer overruns processing ASN.1 strings * CVE-2021-3749: nodejs-axios: Regular expression denial of service in trim function * CVE-2021-41099: redis: Integer overflow issue with strings Bug fixes: * RFE ACM Application management UI doesn't reflect object status (Bugzilla #1965321) * RHACM 2.4 files (Bugzilla #1983663) * Hive Operator CrashLoopBackOff when deploying ACM with latest downstream 2.4 (Bugzilla #1993366) * submariner-addon pod failing in RHACM 2.4 latest ds snapshot (Bugzilla #1994668) * ACM 2.4 install on OCP 4.9 ipv6 disconnected hub fails due to multicluster pod in clb (Bugzilla #2000274) * pre-network-manager-config failed due to timeout when static config is used (Bugzilla #2003915) * InfraEnv condition does not reflect the actual error message (Bugzilla #2009204, 2010030) * Flaky test point to a nil pointer conditions list (Bugzilla #2010175) * InfraEnv status shows 'Failed to create image: internal error (Bugzilla #2010272) * subctl diagnose firewall intra-cluster - failed VXLAN checks (Bugzilla #2013157) * pre-network-manager-config failed due to timeout when static config is used (Bugzilla #2014084) 3. Bugs fixed (https://bugzilla.redhat.com/): 1963121 - CVE-2021-23017 nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name 1965321 - RFE ACM Application management UI doesn't reflect object status 1966615 - CVE-2021-33623 nodejs-trim-newlines: ReDoS in .end() method 1978144 - CVE-2021-32690 helm: information disclosure vulnerability 1983663 - RHACM 2.4.0 images 1990409 - CVE-2021-32804 nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite 1990415 - CVE-2021-32803 nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite 1993366 - Hive Operator CrashLoopBackOff when deploying ACM with latest downstream 2.4 1994668 - submariner-addon pod failing in RHACM 2.4 latest ds snapshot 1995623 - CVE-2021-3711 openssl: SM2 Decryption Buffer Overflow 1995634 - CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings 1999784 - CVE-2021-3749 nodejs-axios: Regular expression denial of service in trim function 2000274 - ACM 2.4 install on OCP 4.9 ipv6 disconnected hub fails due to multicluster pod in clb 2003915 - pre-network-manager-config failed due to timeout when static config is used 2009204 - InfraEnv condition does not reflect the actual error message 2010030 - InfraEnv condition does not reflect the actual error message 2010175 - Flaky test point to a nil pointer conditions list 2010272 - InfraEnv status shows 'Failed to create image: internal error 2010991 - CVE-2021-32687 redis: Integer overflow issue with intsets 2011000 - CVE-2021-32675 redis: Denial of service via Redis Standard Protocol (RESP) request 2011001 - CVE-2021-32672 redis: Out of bounds read in lua debugger protocol parser 2011004 - CVE-2021-32628 redis: Integer overflow bug in the ziplist data structure 2011010 - CVE-2021-32627 redis: Integer overflow issue with Streams 2011017 - CVE-2021-32626 redis: Lua scripts can overflow the heap-based Lua stack 2011020 - CVE-2021-41099 redis: Integer overflow issue with strings 2013157 - subctl diagnose firewall intra-cluster - failed VXLAN checks 2014084 - pre-network-manager-config failed due to timeout when static config is used 5. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: python3 security update Advisory ID: RHSA-2021:4057-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:4057 Issue date: 2021-11-02 CVE Names: CVE-2021-3733 ===================================================================== 1. Summary: An update for python3 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: urllib: Regular expression DoS in AbstractBasicAuthHandler (CVE-2021-3733) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1995234 - CVE-2021-3733 python: urllib: Regular expression DoS in AbstractBasicAuthHandler 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): aarch64: platform-python-debug-3.6.8-39.el8_4.aarch64.rpm platform-python-devel-3.6.8-39.el8_4.aarch64.rpm python3-debuginfo-3.6.8-39.el8_4.aarch64.rpm python3-debugsource-3.6.8-39.el8_4.aarch64.rpm python3-idle-3.6.8-39.el8_4.aarch64.rpm python3-tkinter-3.6.8-39.el8_4.aarch64.rpm ppc64le: platform-python-debug-3.6.8-39.el8_4.ppc64le.rpm platform-python-devel-3.6.8-39.el8_4.ppc64le.rpm python3-debuginfo-3.6.8-39.el8_4.ppc64le.rpm python3-debugsource-3.6.8-39.el8_4.ppc64le.rpm python3-idle-3.6.8-39.el8_4.ppc64le.rpm python3-tkinter-3.6.8-39.el8_4.ppc64le.rpm s390x: platform-python-debug-3.6.8-39.el8_4.s390x.rpm platform-python-devel-3.6.8-39.el8_4.s390x.rpm python3-debuginfo-3.6.8-39.el8_4.s390x.rpm python3-debugsource-3.6.8-39.el8_4.s390x.rpm python3-idle-3.6.8-39.el8_4.s390x.rpm python3-tkinter-3.6.8-39.el8_4.s390x.rpm x86_64: platform-python-3.6.8-39.el8_4.i686.rpm platform-python-debug-3.6.8-39.el8_4.i686.rpm platform-python-debug-3.6.8-39.el8_4.x86_64.rpm platform-python-devel-3.6.8-39.el8_4.i686.rpm platform-python-devel-3.6.8-39.el8_4.x86_64.rpm python3-debuginfo-3.6.8-39.el8_4.i686.rpm python3-debuginfo-3.6.8-39.el8_4.x86_64.rpm python3-debugsource-3.6.8-39.el8_4.i686.rpm python3-debugsource-3.6.8-39.el8_4.x86_64.rpm python3-idle-3.6.8-39.el8_4.i686.rpm python3-idle-3.6.8-39.el8_4.x86_64.rpm python3-test-3.6.8-39.el8_4.i686.rpm python3-tkinter-3.6.8-39.el8_4.i686.rpm python3-tkinter-3.6.8-39.el8_4.x86_64.rpm Red Hat Enterprise Linux BaseOS (v. 8): Source: python3-3.6.8-39.el8_4.src.rpm aarch64: platform-python-3.6.8-39.el8_4.aarch64.rpm python3-debuginfo-3.6.8-39.el8_4.aarch64.rpm python3-debugsource-3.6.8-39.el8_4.aarch64.rpm python3-libs-3.6.8-39.el8_4.aarch64.rpm python3-test-3.6.8-39.el8_4.aarch64.rpm ppc64le: platform-python-3.6.8-39.el8_4.ppc64le.rpm python3-debuginfo-3.6.8-39.el8_4.ppc64le.rpm python3-debugsource-3.6.8-39.el8_4.ppc64le.rpm python3-libs-3.6.8-39.el8_4.ppc64le.rpm python3-test-3.6.8-39.el8_4.ppc64le.rpm s390x: platform-python-3.6.8-39.el8_4.s390x.rpm python3-debuginfo-3.6.8-39.el8_4.s390x.rpm python3-debugsource-3.6.8-39.el8_4.s390x.rpm python3-libs-3.6.8-39.el8_4.s390x.rpm python3-test-3.6.8-39.el8_4.s390x.rpm x86_64: platform-python-3.6.8-39.el8_4.x86_64.rpm python3-debuginfo-3.6.8-39.el8_4.i686.rpm python3-debuginfo-3.6.8-39.el8_4.x86_64.rpm python3-debugsource-3.6.8-39.el8_4.i686.rpm python3-debugsource-3.6.8-39.el8_4.x86_64.rpm python3-libs-3.6.8-39.el8_4.i686.rpm python3-libs-3.6.8-39.el8_4.x86_64.rpm python3-test-3.6.8-39.el8_4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-3733 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYYD6u9zjgjWX9erEAQgCbg//S3byb5BXGosk0v+LDiREjmiOkmk9QpLJ 8SCgT7ap9IRI6rghoGv7bsLpRyydrd8KR0pIDCQOJngEGZfJEUiwk6QhdFs0JHqG aHb1JJCBGTyQ9b0jhrKlJKCvJJk9oscRhkVn2AYm9r4fAnwzSqLaTd+8/PxJrKi+ 7M6I3xh3MYVj5j8Y56GCXYbuAxQqNRPUunzLC8tr79zuVt1iH5qAbff/Dmtkpl4A zDDMp42s7UN1H+Y4pRo9b7MqJLpa1GjuZWsVr53QZu4al7Cbw+iAlz4R2P3pQVKv uHCkl7pWi+v22po5C55+djkPPzzu0NiVJ9CLI/gtI4lx7dJ6uKqNaPvetzuaKaR5 9HEFIRat1V/jD/boAa4gUscosId8h8Arm8UDLaIoJ5IqdNYrRb+AtXpBN2Clg0S2 z9KLbG7jNFAH4sqmIsYz2t+O8pQteMzQdbhoSx8KdaQgIqjUBd+dBXE3P0kndc0g 1No7qsDjavlD31uvXC6K+RO0bESW7kZbcscseO5xiiMNBCbWjKVjKo5DavNxmrTf W4DkMsSzmijKqBsoBgxizFiCF82NH+UXIY/PSNJ4h8KKwi377FRwVvjg8JC5TBPG Wpg6oNbHBTrWEmdlOcL6C13gjIDVtU3lWVomlGYkb7/t4KtjiorJuzuolcqpkRVp YfBN+OdHhpA= =MOG7 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce . Bugs fixed (https://bugzilla.redhat.com/): 1995656 - CVE-2021-36221 golang: net/http/httputil: panic due to racy read of persistConn after handler panic 2016256 - Release of OpenShift Serverless Eventing 1.19.0 2016258 - Release of OpenShift Serverless Serving 1.19.0 5. Bugs fixed (https://bugzilla.redhat.com/): 1983596 - CVE-2021-34558 golang: crypto/tls: certificate of wrong type is causing TLS client to panic 1992006 - CVE-2021-29923 golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet 1998844 - virt-handler Pod is missing xorrisofs command 2008522 - "unable to execute QEMU agent command 'guest-get-users'" logs in virt-launcher pod every 10 seconds 2010334 - VM is not able to be migrated after failed migration 2012328 - 2.6.8 containers 2013494 - [CNV-2.6.8] VMI is in LiveMigrate loop when Upgrading Cluster from 2.6.7/4.7.32 to OCP 4.8.13 5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

resource management error

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Red Hat

SOURCES

LAST UPDATE DATE

2026-08-08T22:24:03.640000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE