PT-2023-12176 · Pypi+2 · Mechanize+2

Erik Krogh Kristensen + 3 · Publicado 2022-04-05 · Atualizado 2025-12-22 · CVE-2021-32837

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions mechanize versions prior to 0.4.6

Description The mechanize library, used for automatically interacting with HTTP web servers, contains a regular expression vulnerable to regular expression denial of service (ReDoS). If a web server responds maliciously, mechanize could crash.

Recommendations For versions prior to 0.4.6, update to version 0.4.6 to resolve the issue. As a temporary workaround, consider restricting interactions with potentially malicious web servers until the patch is applied.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

ALT-PU-2022-1635

ALT-PU-2024-15187

ALT-PU-2024-8936

CVE-2021-32837

DLA-3460-1

DLA-4418-1

GHSA-G3PV-PJ5F-3HFQ

MGASA-2023-0036

OPENSUSE-SU-2023:0030-1

OPENSUSE-SU-2024:12621-1

OPENSUSE-SU-2025:15098-1

PYSEC-2023-25

Produtos afetados

Alt Linux

Debian

Mechanize

Referências · 32

• 🔥 https://github.com/python-mechanize/mechanize/blob/3acb1836f3fd8edc5a758a417dd46b53832ae3b5/mechanize/_urllib2_fork.py#L878-L879 · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2021-108-python-mechanize-mechanize · Exploit
• https://github.com/python-mechanize/mechanize/commit/dd05334448e9f39814bab044d2eaa5ef69b410d6 · Correção
• https://github.com/python-mechanize/mechanize/releases/tag/v0.4.6 · Nota
• https://github.com/python-mechanize/mechanize · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/mechanize/PYSEC-2023-25.yaml · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2023:0030-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1207242 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-32837 · Nota de Segurança
• https://lists.opensuse.org/archives/list/[e-mail]/thread/ALVMKGJWEWB5TB7PXYN2YHAGDNLAFVMJ · Nota
• https://security-tracker.debian.org/tracker/CVE-2021-32837 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=31450 · Nota
• https://suse.com/security/cve/CVE-2021-32837 · Nota
• https://advisories.mageia.org/MGASA-2023-0036.html · Nota de Segurança
• https://lists.debian.org/debian-lts-announce/2023/06/msg00022.html · Nota