CVE-2021-28861: High severity IBM Security Verify Access Docker vulnerability
DISPUTED Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
Other sources
A vulnerability was found in python. This security flaw causes an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of the URI path. This issue may lead to information disclosure.
An open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
References:
https://bugs.python.org/issue43223
— Red Hat
Python could allow a remote attacker to conduct phishing attacks, caused by
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/python3to a version that resolves this vulnerability.Fixed in 0:3.6.8-48.el8_7.1 - Upgrade
Upgrade
redhat/python3.9to a version that resolves this vulnerability.Fixed in 0:3.9.14-1.el9 - Upgrade
Upgrade
redhat/rh-python38-pythonto a version that resolves this vulnerability.Fixed in 0:3.8.14-1.el7 - Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.5+dfsg-2+deb11u4Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 7.3.19+dfsg-1 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u5Fixed in 3.11.2-6+deb12u3 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1+deb11u3
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-28861?
CVE-2021-28861 is a vulnerability in Python 3.x through 3.10 that causes an open redirection vulnerability in lib/http/server.py.
How does CVE-2021-28861 affect the software?
CVE-2021-28861 affects Python 3.x through 3.10.
What is the severity of CVE-2021-28861?
CVE-2021-28861 has a severity rating of high.
What is the impact of CVE-2021-28861?
CVE-2021-28861 may lead to information disclosure.
How can CVE-2021-28861 be fixed?
To fix CVE-2021-28861, update to the recommended versions of Python that have the patch applied.