CVE-2021-28861
Summary
| CVE | CVE-2021-28861 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-08-23 01:15:07 UTC |
| Updated | 2026-10-14 12:17:11 UTC |
| Description | Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks." |
Risk And Classification
Primary CVSS: v3.1 7.4 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Problem Types: CWE-601 | n/a | CWE-601 CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.4 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N |
| 3.1 | ADP | DECLARED | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
ChangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Na | N/a | affected n/a | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
| ADP | Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | affected V3.1.0 V3.1.5 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| cert-portal.siemens.com/productcert/html/ssa-398330.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| [SECURITY] Fedora 37 Update: pypy3.9-7.3.9-4.3.9.fc37 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 37 Update: python3.6-3.6.15-12.fc37 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 36 Update: python3.6-3.6.15-11.fc36 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: pypy3.9-7.3.9-4.3.9.fc35 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: pypy3.7-7.3.9-4.3.7.fc35 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Issue 43223: [security] http.server: Open Redirection if the URL path starts with // - Python tracker | af854a3a-2127-422b-91ae-364da2661108 | bugs.python.org | Issue Tracking, Vendor Advisory |
| gh-87389: Fix an open redirection vulnerability in http.server. by gpshead · Pull Request #93879 · python/cpython · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Patch, Third Party Advisory |
| lists.debian.org/debian-lts-announce/2024/12/msg00000.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| bpo-43223: [SECURITY] Patched Open Redirection In SimpleHTTPServer Module by hamzaavvan · Pull Request #24848 · python/cpython · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Patch, Third Party Advisory |
| [SECURITY] Fedora 35 Update: python3.6-3.6.15-5.fc35 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: python3.9-3.9.14-1.fc35 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: pypy3.8-7.3.9-5.3.8.fc35 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| lists.debian.org/debian-lts-announce/2024/11/msg00024.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| [SECURITY] Fedora 36 Update: pypy3.7-7.3.9-4.3.7.fc36 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 36 Update: pypy3.9-7.3.9-4.3.9.fc36 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 36 Update: pypy3.8-7.3.9-5.3.8.fc36 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Python, PyPy3: Multiple Vulnerabilities (GLSA 202305-02) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| [SECURITY] Fedora 37 Update: pypy3.8-7.3.9-5.3.8.fc37 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 36 Update: mingw-python3-3.10.8-1.fc36 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 37 Update: mingw-python3-3.10.8-1.fc37 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: pypy3.7-7.3.9-4.3.7.fc35 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 36 Update: pypy3.8-7.3.9-5.3.8.fc36 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 37 Update: pypy3.8-7.3.9-5.3.8.fc37 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 36 Update: pypy3.7-7.3.9-4.3.7.fc36 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 36 Update: pypy3.9-7.3.9-4.3.9.fc36 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: pypy3.9-7.3.9-4.3.9.fc35 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 37 Update: mingw-python3-3.10.8-1.fc37 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 37 Update: pypy3.9-7.3.9-4.3.9.fc37 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| FEDORA:FEDORA-2022-7fff0f2b0b | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: python3.6-3.6.15-5.fc35 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 36 Update: python3.6-3.6.15-11.fc36 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 36 Update: mingw-python3-3.10.8-1.fc36 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: python3.9-3.9.14-1.fc35 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| [SECURITY] Fedora 35 Update: pypy3.8-7.3.9-5.3.8.fc35 - package-announce - Fedora Mailing-Lists | MITRE | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160271 Oracle Enterprise Linux Security Update for python3.9 (ELSA-2022-8353)
- 160473 Oracle Enterprise Linux Security Update for python3 (ELSA-2023-0833)
- 160651 Oracle Enterprise Linux Security Update for python38:3.8 and python38-devel:3.8 (ELSA-2023-2763)
- 160687 Oracle Enterprise Linux Security Update for python39:3.9 and python39-devel:3.9 (ELSA-2023-2764)
- 199497 Ubuntu Security Notification for Python Vulnerabilities (USN-5888-1)
- 240700 Red Hat Update for rh-python38-python (RHSA-2022:6766)
- 240914 Red Hat Update for python3.9 security (RHSA-2022:8353)
- 241211 Red Hat Update for python3 (RHSA-2023:0833)
- 241481 Red Hat Update for python38:3.8 and python38-devel:3.8 (RHSA-2023:2763)
- 241507 Red Hat Update for python39:3.9 and python39-devel:3.9 (RHSA-2023:2764)
- 283111 Fedora Security Update for python3.8 (FEDORA-2022-29d436596f)
- 283112 Fedora Security Update for python3.7 (FEDORA-2022-8535093cba)
- 283139 Fedora Security Update for python3.9 (FEDORA-2022-f511f8f58b)
- 283159 Fedora Security Update for python3.6 (FEDORA-2022-a27e239f5a)
- 283160 Fedora Security Update for python3.6 (FEDORA-2022-a2be4bd5d8)
- 283220 Fedora Security Update for pypy3.8 (FEDORA-2022-fde69532df)
- 283221 Fedora Security Update for pypy3.8 (FEDORA-2022-15f1aa7dc7)
- 283225 Fedora Security Update for pypy3.9 (FEDORA-2022-4ac2e16969)
- 283231 Fedora Security Update for pypy3.9 (FEDORA-2022-61d8e8d880)
- 283247 Fedora Security Update for pypy3.7 (FEDORA-2022-2173709172)
- 283248 Fedora Security Update for pypy3.7 (FEDORA-2022-01d5789c08)
- 283294 Fedora Security Update for mingw (FEDORA-2022-d1682fef04)
- 283444 Fedora Security Update for mingw (FEDORA-2022-79843dfb3c)
- 283483 Fedora Security Update for pypy3.9 (FEDORA-2022-7ca361a226)
- 283484 Fedora Security Update for pypy3.8 (FEDORA-2022-20116fb6aa)
- 285297 Fedora Security Update for pypy3.10 (FEDORA-2023-ddde191e04)
- 672260 EulerOS Security Update for python3 (EulerOS-SA-2022-2661)
- 672314 EulerOS Security Update for python3 (EulerOS-SA-2022-2693)
- 672343 EulerOS Security Update for python3 (EulerOS-SA-2022-2773)
- 672368 EulerOS Security Update for python3 (EulerOS-SA-2022-2738)
- 672399 EulerOS Security Update for python3 (EulerOS-SA-2022-2805)
- 710714 Gentoo Linux Python, PyPy3 Multiple Vulnerabilities (GLSA 202305-02)
- 752642 SUSE Enterprise Linux Security Update for python36 (SUSE-SU-2022:3483-1)
- 752643 SUSE Enterprise Linux Security Update for python39 (SUSE-SU-2022:3485-1)
- 752652 SUSE Enterprise Linux Security Update for python (SUSE-SU-2022:3512-1)
- 752656 SUSE Enterprise Linux Security Update for python3 (SUSE-SU-2022:3511-1)
- 752661 SUSE Enterprise Linux Security Update for python3 (SUSE-SU-2022:3544-1)
- 752667 SUSE Enterprise Linux Security Update for python (SUSE-SU-2022:3553-1)
- 752672 SUSE Enterprise Linux Security Update for python3 (SUSE-SU-2022:3593-1)
- 752676 SUSE Enterprise Linux Security Update for python (SUSE-SU-2022:3512-2)
- 752687 SUSE Enterprise Linux Security Update for python3 (SUSE-SU-2022:3511-2)
- 902780 Common Base Linux Mariner (CBL-Mariner) Security Update for python3 (10625)
- 902788 Common Base Linux Mariner (CBL-Mariner) Security Update for python3 (10618)
- 903967 Common Base Linux Mariner (CBL-Mariner) Security Update for python3 (10618-1)
- 903988 Common Base Linux Mariner (CBL-Mariner) Security Update for python3 (10625-1)
- 940790 AlmaLinux Security Update for python3.9 (ALSA-2022:8353)
- 940928 AlmaLinux Security Update for python3 (ALSA-2023:0833)
- 941099 AlmaLinux Security Update for python39:3.9 and python39-devel:3.9 (ALSA-2023:2764)
- 941101 AlmaLinux Security Update for python38:3.8 and python38-devel:3.8 (ALSA-2023:2763)
- 960542 Rocky Linux Security Update for python3.9 (RLSA-2022:8353)
- 960653 Rocky Linux Security Update for python3 (RLSA-2023:0833)