Bug 799413 (CVE-2021-33503)

Summary:	<dev-python/urllib3-1.26.5: ReDoS vulnerability (CVE-2021-33503)
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	mgorny, python
Priority:	Normal	Keywords:	ALLARCHES
Version:	unspecified	Flags:	nattka: sanity-check+
Hardware:	All
OS:	Linux
URL:	https://github.com/advisories/GHSA-q2q7-5pp4-w6pg
Whiteboard:	A3 [glsa+ cve]
Package list:	dev-python/urllib3-1.26.5	Runtime testing required:	---

Description John Helmert III archtester

2021-07-01 02:10:53 UTC

CVE-2021-33503:

An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.


Please stabilize.

Comment 1 Sam James archtester

2021-07-01 08:59:46 UTC

amd64 arm arm64 hppa ppc ppc64 sparc x86 (ALLARCHES) done

all arches done

Comment 2 John Helmert III archtester

2021-07-13 14:50:20 UTC

GLSA request filed.

Comment 3 GLSAMaker/CVETool Bot gentoo-dev

2021-07-15 05:26:24 UTC

This issue was resolved and addressed in
 GLSA 202107-36 at https://security.gentoo.org/glsa/202107-36
by GLSA coordinator John Helmert III (ajak).

Comment 4 John Helmert III archtester

2021-07-15 05:31:11 UTC

Reopening for cleanup

Comment 5 Larry the Git Cow gentoo-dev

2021-07-15 17:06:14 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f47a46e8ba0bc6982eab353a5e69e8e143e7e2d7

commit f47a46e8ba0bc6982eab353a5e69e8e143e7e2d7
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2021-07-15 17:04:21 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2021-07-15 17:04:24 +0000

    dev-python/urllib3: Remove old
    
    Bug: https://bugs.gentoo.org/799413
    Signed-off-by: Michał Górny <mgorny@gentoo.org>

 dev-python/urllib3/Manifest                        |  1 -
 .../files/urllib3-1.26.4-test-ssltransport.patch   | 31 -------
 dev-python/urllib3/urllib3-1.26.4.ebuild           | 97 ----------------------
 3 files changed, 129 deletions(-)

Comment 6 John Helmert III archtester

2021-07-15 17:11:48 UTC

Thank you! All done.