ASA-202106-25 log generated external raw

Arch Linux Security Advisory ASA-202106-25 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-33503 Package : python-urllib3 Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-2038 Summary ======= The package python-urllib3 before version 1.26.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.26.5-1. # pacman -Syu "python-urllib3>=1.26.5-1" The problem has been fixed upstream in version 1.26.5. Workaround ========== None. Description =========== A security issue has been found in python-urllib3 before version 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL was passed as a parameter or redirected to via an HTTP redirect. Impact ====== A remote attacker could exhaust CPU resources, leading to denial of service, using a crafted URL. References ========== https://github.com/urllib3/urllib3/security/advisories/GHSA-q2q7-5pp4-w6pg https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec https://security.archlinux.org/CVE-2021-33503