ASA-202106-25 log original external raw

[ASA-202106-25] python-urllib3: denial of service
Arch Linux Security Advisory ASA-202106-25 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-33503 Package : python-urllib3 Type : denial of service Remote : Yes Link : Summary ======= The package python-urllib3 before version 1.26.5-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.26.5-1. # pacman -Syu "python-urllib3>=1.26.5-1" The problem has been fixed upstream in version 1.26.5. Workaround ========== None. Description =========== A security issue has been found in python-urllib3 before version 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL was passed as a parameter or redirected to via an HTTP redirect. Impact ====== A remote attacker could exhaust CPU resources, leading to denial of service, using a crafted URL. References ==========