CVE-2022-40899

An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
CISA-ADPADP
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 60%
VendorProductVersion
pythoncharmerspython-future
𝑥
≤ 0.18.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-future
bullseye
no-dsa
bookworm
no-dsa
buster
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-future
kinetic
Fixed 0.18.2-6ubuntu0.1
released
jammy
Fixed 0.18.2-5ubuntu0.1
released
focal
Fixed 0.18.2-2ubuntu0.1
released
bionic
Fixed 0.15.2-4ubuntu2.1
released
xenial
Fixed 0.15.2-1ubuntu0.1~esm1
released
trusty
ignored
Common Weakness Enumeration
References
https://github.com/PythonCharmers/python-future/blob/master/src/future/backports/http/cookiejar.py#L215
https://github.com/PythonCharmers/python-future/pull/610
https://github.com/python/cpython/pull/17157
https://pypi.org/project/future/
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
https://github.com/PythonCharmers/python-future/blob/master/src/future/backports/http/cookiejar.py#L215
https://github.com/PythonCharmers/python-future/pull/610
https://github.com/python/cpython/pull/17157
https://pypi.org/project/future/
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/