Path to dependency file: /tmp/ws-ua_20220122232947_MZFNWS/archiveExtraction_KXRZMM/PZSZKX/20220122232947/codechung_depth_0/awscli-bundle/packages/awscli-1.18.125.tar/awscli-1.18.125
Path to vulnerable library: /tmp/ws-ua_20220122232947_MZFNWS/archiveExtraction_KXRZMM/PZSZKX/20220122232947/codechung_depth_0/awscli-bundle/packages/awscli-1.18.125.tar/awscli-1.18.125,/tmp/ws-ua_20220122232947_MZFNWS/archiveExtraction_KXRZMM/PZSZKX/20220122232947/codechung_depth_1/awscli-bundle/awscli-bundle/packages/awscli-1.18.125.tar/awscli-1.18.125,/awscli-bundle/packages/botocore-1.17.48.tar/botocore-1.17.48,/awscli-bundle/awscli-bundle/packages/botocore-1.17.48.tar/botocore-1.17.48
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
CVE-2021-33503 - High Severity Vulnerability
urllib3-1.25.11-py2.py3-none-any.whl
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/56/aa/4ef5aa67a9a62505db124a5cb5262332d1d4153462eb8fd89c9fa41e5d92/urllib3-1.25.11-py2.py3-none-any.whl
Path to dependency file: /tmp/ws-ua_20220122232947_MZFNWS/archiveExtraction_KXRZMM/PZSZKX/20220122232947/codechung_depth_0/awscli-bundle/packages/awscli-1.18.125.tar/awscli-1.18.125
Path to vulnerable library: /tmp/ws-ua_20220122232947_MZFNWS/archiveExtraction_KXRZMM/PZSZKX/20220122232947/codechung_depth_0/awscli-bundle/packages/awscli-1.18.125.tar/awscli-1.18.125,/tmp/ws-ua_20220122232947_MZFNWS/archiveExtraction_KXRZMM/PZSZKX/20220122232947/codechung_depth_1/awscli-bundle/awscli-bundle/packages/awscli-1.18.125.tar/awscli-1.18.125,/awscli-bundle/packages/botocore-1.17.48.tar/botocore-1.17.48,/awscli-bundle/awscli-bundle/packages/botocore-1.17.48.tar/botocore-1.17.48
Dependency Hierarchy: - :x: **urllib3-1.25.11-py2.py3-none-any.whl** (Vulnerable Library)
urllib3-1.25.7.tar.gz
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/ad/fc/54d62fa4fc6e675678f9519e677dfc29b8964278d75333cf142892caf015/urllib3-1.25.7.tar.gz
Path to vulnerable library: /awscli-bundle/packages/urllib3-1.25.7.tar.gz,/awscli-bundle/awscli-bundle/packages/urllib3-1.25.7.tar.gz
Dependency Hierarchy: - :x: **urllib3-1.25.7.tar.gz** (Vulnerable Library)
urllib3-1.25.10.tar.gz
HTTP library with thread-safe connection pooling, file post, and more.
Library home page: https://files.pythonhosted.org/packages/81/f4/87467aeb3afc4a6056e1fe86626d259ab97e1213b1dfec14c7cb5f538bf0/urllib3-1.25.10.tar.gz
Path to vulnerable library: /awscli-bundle/packages/urllib3-1.25.10.tar.gz,/awscli-bundle/awscli-bundle/packages/urllib3-1.25.10.tar.gz
Dependency Hierarchy: - :x: **urllib3-1.25.10.tar.gz** (Vulnerable Library)
Found in HEAD commit: de1c2b0d1a23367b161c2d995029f9693bd8a155
Found in base branch: master
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
Publish Date: 2021-06-29
URL: CVE-2021-33503
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/urllib3/urllib3/security/advisories/GHSA-q2q7-5pp4-w6pg
Release Date: 2021-06-29
Fix Resolution: 1.26.5
Step up your Open Source Security Game with Mend here