7.4

CVE-2021-28861: fedoraproject fedora URL Redirection to Untrusted Site

Modified
AliasesSUSE-SU-2022:3483-1SUSE-SU-2022:3511-1SUSE-SU-2022:3511-2
Published 23-08-2022Last modified 14-10-2026

Vulnerability summary

CVE-2021-28861 is a high (CVSS 7.4) URL Redirection to Untrusted Site vulnerability in fedoraproject fedora. EPSS estimates a 2.68% chance of exploitation in the next 30 days, higher than 85.8% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.4/10
010
High · v3.1 (NVD)
EPSS score
2.68%
0%100%
Low · +0.15 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 3
DLA-3966-1DLA-3980-1MGASA-2022-0359RHSA-2022:6766RHSA-2022:8353RHSA-2023:0833

Timeline

  1. 23-08-2022
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

2.68%

Chance of exploitation in the next 30 days

Percentile

86%

Versus all other CVEs

30-day change

Increase +0.15 pp

From 2.54% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Suse143 products
  • python-base&distro=SUSE Enterprise Storage 6< 2.7.18-150000.44.1
  • python-base&distro=SUSE Enterprise Storage 7< 2.7.18-150000.44.1
  • python-base&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.7.18-150000.44.1
  • python-base&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.7.18-150000.44.1
  • python-base&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS< 2.7.18-150000.44.1
Opensuse18 products
  • python-base&distro=openSUSE Leap 15.3< 2.7.18-150000.44.1
  • python-base&distro=openSUSE Leap 15.4< 2.7.18-150000.44.1
  • python-doc&distro=openSUSE Leap 15.3< 2.7.18-150000.44.1
  • python-doc&distro=openSUSE Leap 15.4< 2.7.18-150000.44.1
  • python3-core&distro=openSUSE Leap 15.3< 3.6.15-150300.10.30.1
Ubuntu3 products
  • python3.10< 3.10.6-1~22.04.1
  • python3.5< 3.5.2-2ubuntu0~16.04.13+esm5
  • python3.9< 3.9.5-3ubuntu0~20.04.1+esm1
Debian2 products
  • pypy3< 7.3.10+dfsg-1
  • python3.11< 3.11.0~b4-1
Fedoraproject1 product
Python1 product
  • python≥ 3.0.0, < 3.7.14 | ≥ 3.8.0, < 3.8.14 | ≥ 3.9.0, < 3.9.14 | ≥ 3.10.0, < 3.10.6 | 3.11.0:alpha1 | 3.11.0:alpha2 | 3.11.0:alpha3 | 3.11.0:alpha4 | 3.11.0:alpha5 | 3.11.0:alpha6 | 3.11.0:alpha7 | 3.11.0:beta1 | 3.11.0:beta2 | 3.11.0:beta3

6 vendors · 168 products

References

39 links
Show all 39 references