CVE-2021-28861
HIGH7.4EPSS 1.4%Published: 8/23/2022Modified: 4/28/2026
Description
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."
Affected packages (7)
- Bitnami/libpython>= 3.0.0, < 3.7.14, >= 3.8.0, < 3.8.14, >= 3.9.0, < 3.9.14, >= 3.10.0, < 3.10.6
- Bitnami/python>= 3.0.0, < 3.7.14, >= 3.8.0, < 3.8.14, >= 3.9.0, < 3.9.14, >= 3.10.0, < 3.10.6
- Bitnami/python-min>= 3.0.0, < 3.7.14, >= 3.8.0, < 3.8.14, >= 3.9.0, < 3.9.14, >= 3.10.0, < 3.10.6
- Debian/pypy3from 0, < 7.3.5+dfsg-2+deb11u4
- Debian/python2.7from 0
- Debian/python3.11from 0, < 3.11.0~b4-1
- Debian/python3.9from 0, < 3.9.2-1+deb11u2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
References (22)
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2021-28861
- WEBhttps://bugs.python.org/issue43223
- WEBhttps://github.com/python/cpython/pull/24848
- WEBhttps://github.com/python/cpython/pull/93879
- WEBhttps://lists.debian.org/debian-lts-announce/2024/11/msg00024.html
- WEBhttps://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2TRINJE3INWDVIHIABW4L2NP3RUSK7BJ/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LTSPFIULY2GZJN3QYNFVM4JSU6H4D6J/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OABQ5CMPQETJLFHROAXDIDXCMDTNVYG/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DISZAFSIQ7IAPAEQTC7G2Z5QUA2V2PSW/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HPX4XHT2FGVQYLY2STT2MRVENILNZTTU/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I3MQT5ZE3QH5PVDJMERTBOCILHK35CBE/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KRGKPYA5YHIXQAMRIXO5DSCX7D4UUW4Q/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLE5INSVJUZJGY5OJXV6JREXWD7UDHYN/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S7G66SRWUM36ENQ3X6LAIG7HAB27D4XJ/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZEPOPUFC42KXXSLFPZ47ZZRGPOR7SQE/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/
- WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X46T4EFTIBXZRYTGASBDEZGYJINH2OWV/
- WEBhttps://nvd.nist.gov/vuln/detail/CVE-2021-28861
- WEBhttps://security.gentoo.org/glsa/202305-02