01 Record

CVE-2021-3733

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression

UnratedPUBLISHEDCNA: redhat

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects to, could trigger a Regular Expression

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

4.79% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 91.8% of scored records. A rank, not a probability.

NVD base score

6.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-14.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2022-03-07 00:00Z4 YR AGO

Last updated

2026-10-14 09:49Z14 DAYS AGO

Reserved

2021-08-23

Assigning CNA

redhat

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-400Uncontrolled Resource ConsumptionClass

Data version

5.2

Document digest

4b62e0bcade47944943b284cdc4c5762d0c88b45e1b4fce55b7bed0957a7a66a

05 Affected products

VendorProductVersionsPlatforms

n/apythonFixed in python v3.6.14, python v3.7.11, python v3.8.10, python v3.9.5.—

06 References

bugs.python.orghttps://bugs.python.org/issue43075
bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1995234
github.comhttps://github.com/python/cpython/pull/24391
ubuntu.comhttps://ubuntu.com/security/CVE-2021-3733
github.comhttps://github.com/python/cpython/commit/7215d1ae25525c92b026166f9d5cac85fb
security.netapp.comhttps://security.netapp.com/advisory/ntap-20220407-0001/
lists.debian.org[debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security updatehttps://lists.debian.org/debian-lts-announce/2023/05/msg00024.htmlmailing-list
lists.debian.org[debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security updatehttps://lists.debian.org/debian-lts-announce/2023/06/msg00039.htmlmailing-list
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-398330.html

07 Fixed in

AlmaLinux 8

babel
Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
python-nose-docs
Fixed

A version is affected if any line below covers it.
- Affected before 1.3.7-31.module_el8.5.0+2569+5c5719bc
- Affected before 1.3.7-31.module_el8.6.0+2781+fed64c13
python-psycopg2-doc
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python-sqlalchemy-doc
Fixed

A version is affected if any line below covers it.
- Affected before 1.3.2-2.module_el8.5.0+2569+5c5719bc
- Affected before 1.3.2-2.module_el8.6.0+2781+fed64c13
python2
Fixed in 2.7.18-10.module_el8.6.0+2781+fed64c13.alma
python2-Cython
Fixed in 0.28.1-7.module_el8.6.0+2781+fed64c13
python2-PyMySQL
Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
python2-attrs
Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
python2-babel
Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
python2-backports
Fixed in 1.0-16.module_el8.6.0+2781+fed64c13
python2-backports-ssl_match_hostname
Fixed in 3.5.0.1-12.module_el8.6.0+2781+fed64c13
python2-bson
Fixed in 3.7.0-1.module_el8.6.0+2781+fed64c13
python2-chardet
Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
python2-coverage
Fixed in 4.5.1-4.module_el8.6.0+2781+fed64c13
python2-debug
Fixed in 2.7.18-10.module_el8.6.0+2781+fed64c13.alma
python2-devel
Fixed in 2.7.18-10.module_el8.6.0+2781+fed64c13.alma
python2-dns
Fixed in 1.15.0-10.module_el8.6.0+2781+fed64c13
python2-docs
Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
python2-docs-info
Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
python2-docutils
Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
python2-funcsigs
Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
python2-idna
Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
python2-ipaddress
Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
python2-jinja2
Fixed in 2.10-9.module_el8.6.0+2781+fed64c13
python2-libs
Fixed in 2.7.18-10.module_el8.6.0+2781+fed64c13.alma
python2-lxml
Fixed in 4.2.3-6.module_el8.6.0+2781+fed64c13
python2-markupsafe
Fixed in 0.23-19.module_el8.6.0+2781+fed64c13
python2-mock
Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
python2-nose
Fixed in 1.3.7-31.module_el8.6.0+2781+fed64c13
python2-numpy
Fixed in 1:1.14.2-16.module_el8.6.0+2781+fed64c13
python2-numpy-doc
Fixed in 1:1.14.2-16.module_el8.6.0+2781+fed64c13
python2-numpy-f2py
Fixed in 1:1.14.2-16.module_el8.6.0+2781+fed64c13
python2-pip
Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
python2-pip-wheel
Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
python2-pluggy
Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
python2-psycopg2
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-debug
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-tests
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-py
Fixed in 1.5.3-6.module_el8.6.0+2781+fed64c13
python2-pygments
Fixed in 2.2.0-22.module_el8.6.0+2781+fed64c13

109 further packages in AlmaLinux 8 not shown (first 40 listed).

CloudLinux 8

babel
Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
python-nose-docs
Fixed

A version is affected if any line below covers it.
- Affected before 1.3.7-31.module_el8.5.0+2569+5c5719bc
- Affected before 1.3.7-31.module_el8.6.0+2781+fed64c13
python-psycopg2-doc
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python-sqlalchemy-doc
Fixed

A version is affected if any line below covers it.
- Affected before 1.3.2-2.module_el8.5.0+2569+5c5719bc
- Affected before 1.3.2-2.module_el8.6.0+2781+fed64c13
python2
Fixed in 2.7.18-10.module_el8.6.0+2781+fed64c13.alma
python2-Cython
Fixed in 0.28.1-7.module_el8.6.0+2781+fed64c13
python2-PyMySQL
Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
python2-attrs
Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
python2-babel
Fixed in 2.5.1-10.module_el8.6.0+2781+fed64c13
python2-backports
Fixed in 1.0-16.module_el8.6.0+2781+fed64c13
python2-backports-ssl_match_hostname
Fixed in 3.5.0.1-12.module_el8.6.0+2781+fed64c13
python2-bson
Fixed in 3.7.0-1.module_el8.6.0+2781+fed64c13
python2-chardet
Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
python2-coverage
Fixed in 4.5.1-4.module_el8.6.0+2781+fed64c13
python2-debug
Fixed in 2.7.18-10.module_el8.6.0+2781+fed64c13.alma
python2-devel
Fixed in 2.7.18-10.module_el8.6.0+2781+fed64c13.alma
python2-dns
Fixed in 1.15.0-10.module_el8.6.0+2781+fed64c13
python2-docs
Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
python2-docs-info
Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
python2-docutils
Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
python2-funcsigs
Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
python2-idna
Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
python2-ipaddress
Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
python2-jinja2
Fixed in 2.10-9.module_el8.6.0+2781+fed64c13
python2-libs
Fixed in 2.7.18-10.module_el8.6.0+2781+fed64c13.alma
python2-lxml
Fixed in 4.2.3-6.module_el8.6.0+2781+fed64c13
python2-markupsafe
Fixed in 0.23-19.module_el8.6.0+2781+fed64c13
python2-mock
Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
python2-nose
Fixed in 1.3.7-31.module_el8.6.0+2781+fed64c13
python2-numpy
Fixed in 1:1.14.2-16.module_el8.6.0+2781+fed64c13
python2-numpy-doc
Fixed in 1:1.14.2-16.module_el8.6.0+2781+fed64c13
python2-numpy-f2py
Fixed in 1:1.14.2-16.module_el8.6.0+2781+fed64c13
python2-pip
Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
python2-pip-wheel
Fixed in 9.0.3-19.module_el8.6.0+2781+fed64c13
python2-pluggy
Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
python2-psycopg2
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-debug
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-tests
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-py
Fixed in 1.5.3-6.module_el8.6.0+2781+fed64c13
python2-pygments
Fixed in 2.2.0-22.module_el8.6.0+2781+fed64c13

109 further packages in CloudLinux 8 not shown (first 40 listed).

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Debian 12

pypy3
Fixed in 7.3.5+dfsg-2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

pypy3
Fixed in 7.3.5+dfsg-2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

pypy3
Fixed in 7.3.5+dfsg-2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

python3.6
Fixed in 3.6.9-1~18.04ubuntu1.6
python3.7
Fixed in 3.7.5-2ubuntu1~18.04.2
python3.8
Fixed in 3.8.0-3ubuntu1~18.04.2

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 20.04 LTS

python3.8
Fixed in 3.8.10-0ubuntu1~20.04
python3.9
Fixed in 3.9.5-3~20.04.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 14.04 LTS

python3.4
Fixed in 3.4.3-1ubuntu1~14.04.7+esm11
Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
python3.5
Fixed in 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 16.04 LTS

python3.5
Fixed in 3.5.2-2ubuntu0~16.04.13+esm1
Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.