cve/2020/CVE-2020-8492.md

CVE-2020-8492

Description

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

POC

Reference

• https://github.com/python/cpython/pull/18284
• https://github.com/python/cpython/pull/18284

Github

• https://github.com/doyensec/regexploit
• https://github.com/engn33r/awesome-redos-security
• https://github.com/retr0-13/regexploit