CVE-2021-3737: High severity Python Python vulnerability
A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.
Other sources
HTTP client can get stuck infinitely reading len(line) < 64k lines after receiving a '100 Continue' HTTP response. This could lead to the client being a bandwidth sink for anyone in control of a server.
References:
https://bugs.python.org/issue44022 https://github.com/python/cpython/pull/25916 https://github.com/python/cpython/pull/26503 https://build.opensuse.org/package/viewfile/devel:languages:python:Factory/python/bpo44022-fix-http-client-infinite-line-reading-after-a-HTTP-100-Continue.patch?expand=1 https://bugzilla.redhat.com/showbug.cgi?id=1991918
— Red Hat
Python is vulnerable to a denial of service, caused by improper handling of HTTP response in the HTTP client code. By persuading a victim to visit a specially-crafted web site, a remote attacker could exploit this vulnerability to cause the client script enter an infinite loop, and results in a denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3737?
CVE-2021-3737 is a vulnerability in Python that allows a remote attacker to cause a denial of service by making the client script enter an infinite loop.
What is the severity of CVE-2021-3737?
The severity of CVE-2021-3737 is high with a CVSS score of 7.5.
How does CVE-2021-3737 affect Python?
CVE-2021-3737 affects Python versions 3.6.0 to 3.6.14, 3.7.0 to 3.7.11, 3.8.0 to 3.8.11, and 3.9.0 to 3.9.6.
How can I fix CVE-2021-3737?
To fix CVE-2021-3737, update Python to version 3.6.15, 3.7.12, 3.8.12, or 3.9.7, depending on your installed version.
Where can I find more information about CVE-2021-3737?
You can find more information about CVE-2021-3737 on the official Python bug tracker and GitHub repository.