CVE-2021-28861: High severity IBM Security Verify Access Docker vulnerability
DISPUTED Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
Other sources
A vulnerability was found in python. This security flaw causes an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of the URI path. This issue may lead to information disclosure.
An open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure.
References:
https://bugs.python.org/issue43223
— Red Hat
Python could allow a remote attacker to conduct phishing attacks, caused by
Affected Software
Remediation
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-28861?
CVE-2021-28861 is a vulnerability in Python 3.x through 3.10 that causes an open redirection vulnerability in lib/http/server.py.
How does CVE-2021-28861 affect the software?
CVE-2021-28861 affects Python 3.x through 3.10.
What is the severity of CVE-2021-28861?
CVE-2021-28861 has a severity rating of high.
What is the impact of CVE-2021-28861?
CVE-2021-28861 may lead to information disclosure.
How can CVE-2021-28861 be fixed?
To fix CVE-2021-28861, update to the recommended versions of Python that have the patch applied.