CVE-2021-3737

Aliases:DEBIAN-CVE-2021-3737
Advisory lineage Upstream: 0 Downstream: 32
Modified
Published: 04 Mar 2022, 00:00
Last modified:17 Dec 2025, 21:32

Vulnerability Summary

Overall Risk (default)
medium
42/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
11.59% MEDIUM
12% probability +11.42%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

04 Mar 2022, 00:00
Published
Vulnerability first disclosed
17 Dec 2025, 21:32
Last Modified
Vulnerability information updated

Description

A flaw was found in python. An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. The highest threat from this vulnerability is to system availability.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v2.0•HIGH•Score: 7.1AV:N/AC:M/Au:N/C:N/I:N/A:C

EPSS Trends

Current EPSS score: 11.59%• Percentile: 96%

Techniques & Countermeasures

  • CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

    The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • canonical•ubuntu_linux

    14.04 | 16.04 | 18.04 | 20.04 | 21.04

  • debian•pypy3

    < 7.3.5+dfsg-2+deb11u4 | < 7.3.8+dfsg-1 | < 7.3.8+dfsg-1 | < 7.3.8+dfsg-1

  • debian•python2.7

    all

  • debian•python3.9

    < 3.9.2-1+deb11u2

  • fedoraproject•fedora

    33 | 34

  • netapp•hci

    na

  • netapp•management_services_for_element_software

    na

  • netapp•netapp_xcp_smb

    na

  • netapp•ontap_select_deploy_administration_utility

    na

  • netapp•xcp_nfs

    na

  • oracle•communications_cloud_native_core_binding_support_function

    22.1.3

  • oracle•communications_cloud_native_core_network_exposure_function

    22.1.1

  • oracle•communications_cloud_native_core_policy

    22.2.0

  • python•python

    ≥ 3.6.0, < 3.6.14 | ≥ 3.7.0, < 3.7.11 | ≥ 3.8.0, < 3.8.11 | ≥ 3.9.0, < 3.9.6

  • redhat•codeready_linux_builder

    8.0

  • redhat•codeready_linux_builder_for_ibm_z_systems

    8.0

  • redhat•codeready_linux_builder_for_power_little_endian

    8.0

  • redhat•enterprise_linux

    6.0 | 7.0 | 8.0

  • redhat•enterprise_linux_for_ibm_z_systems

    8.0

  • redhat•enterprise_linux_for_power_little_endian

    8.0

References (13)