CVE-2020-8492: canonical ubuntu_linux Uncontrolled Resource Consumption
Vulnerability summary
CVE-2020-8492 is a high (CVSS 7.1) Uncontrolled Resource Consumption vulnerability in canonical ubuntu_linux. EPSS estimates a 6.62% chance of exploitation in the next 30 days, higher than 93.8% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 34 · Related 27Timeline
- 30-01-2020PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
6.62%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
No change 0.00 pp
From 6.62% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (python-security.readthedocs.io)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Suse6 products
- python-base&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 2.6.9-40.35.1
- python-base&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 2.6.9-40.35.1
- python-doc&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 2.6-8.40.35.1
- python-doc&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 2.6-8.40.35.1
- python&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 2.6.9-40.35.2
Ubuntu6 products
- python2.7< 2.7.6-8ubuntu0.6+esm5 | < 2.7.12-1ubuntu0~16.04.11 | < 2.7.17-1~18.04ubuntu1 | < 2.7.18-1~20.04.1
- python3.4< 3.4.3-1ubuntu1~14.04.7+esm6
- python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.10
- python3.6< 3.6.9-1~18.04ubuntu1
- python3.7< 3.7.5-2ubuntu1~18.04.2
Debian2 products
- python2.7< 2.7.18-2
- debian_linuxEOL9.0
Alpine1 product
- python3< 3.7.7-r0 | < 3.8.2-r0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.10 | 20.04
Fedoraproject1 product
- fedoraEOL31 | 32
Opensuse1 product
- leapEOL15.1
Python1 product
- python≥ 2.7.0, ≤ 2.7.17 | ≥ 3.5.0, ≤ 3.5.9 | ≥ 3.6.0, ≤ 3.6.10 | ≥ 3.7.0, ≤ 3.7.6 | ≥ 3.8.0, ≤ 3.8.1
8 vendors · 19 products
References
30 links- security.netapp.com/advisory/ntap-20200221-0001/Third Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.htmlVendor AdvisoryThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
Show all 30 references
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.apache.org/thread.html/…Mailing List
- lists.apache.org/thread.html/…Mailing List