⌘ + K

UBUNTU-CVE-2020-8492

Dashboard / Vulnerabilities / UBUNTU-CVE-2020-8492

UBUNTU-CVE-2020-8492

Published: 30 Jan 2020Last Modified: 22 Apr 2026

Upstream:

Aliases:

Summary:

Details: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

References: https://ubuntu.com/security/CVE-2020-8492, https://github.com/python/cpython/pull/18284, https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html, https://github.com/python/cpython/commit/0b297d4ff1c0e4480ad33acae793fbaf4bf015b4, https://ubuntu.com/security/notices/USN-4333-1, https://ubuntu.com/security/notices/USN-4333-2, https://ubuntu.com/security/notices/USN-4754-3, https://ubuntu.com/security/notices/USN-5200-1, https://www.cve.org/CVERecord?id=CVE-2020-8492, https://ubuntu.com/security/notices/USN-6891-1

Affected packages

Package

Name: python2.7

Purl: pkg:deb/ubuntu/[email protected]+esm5?arch=source&distro=trusty/esm

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -2.7.6-8ubuntu0.6+esm5

Affected versions

2.7.5-8ubuntu3

2.7.5-8ubuntu4

2.7.6-2

2.7.6-2ubuntu1

2.7.6-3

2.7.6-3ubuntu1

2.7.6-4

2.7.6-4ubuntu1

2.7.6-5

2.7.6-7

2.7.6-8

2.7.6-8ubuntu0.2

2.7.6-8ubuntu0.3

2.7.6-8ubuntu0.4

2.7.6-8ubuntu0.5

2.7.6-8ubuntu0.6+esm2

2.7.6-8ubuntu0.6+esm3

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High