Skip to content
Fencer Intel
medium 6.5

CVE-2021-28861 json

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginn…

published 4y ago modified 26d ago also BIT-libpython-2021-28861 , BIT-python-2021-28861 , BIT-python-min-2021-28861 , EUVD-2021-15514

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

Patch / fix

  • bitnami libpython 3.7.14, 3.8.14, 3.9.14, 3.10.6
  • bitnami python 3.7.14, 3.8.14, 3.9.14, 3.10.6
  • bitnami python-min 3.7.14, 3.8.14, 3.9.14, 3.10.6
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • pypy3 Debian 14, Debian 13, Debian 12 7.3.10+dfsg-1
  • python3.11 Debian 12 3.11.0~b4-1

debian advisories DEBIAN-CVE-2021-28861

  • python3.10 Ubuntu 22.04 LTS 3.10.6-1~22.04.1
  • python3.5 Ubuntu Pro 16.04 LTS 3.5.2-2ubuntu0~16.04.13+esm5
  • python3.9 Ubuntu Pro 20.04 LTS 3.9.5-3ubuntu0~20.04.1+esm1

ubuntu advisories UBUNTU-CVE-2021-28861

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • numpy RHEL 8 1.19.4-3.module+el8.5.0+12204+54860423
  • scipy RHEL 8 1.5.4-3.module+el8.4.0+9822+20bf1249
  • Cython RHEL 8 0.29.21-5.module+el8.4.0+9822+20bf1249
  • pytest RHEL 8 6.0.2-2.module+el8.4.0+9822+20bf1249
  • PyYAML RHEL 8 5.4.1-1.module+el8.5.0+10613+59a13ec4
  • mod_wsgi RHEL 8 4.7.1-5.module+el8.7.0+16654+645aad7f
  • pybind11 RHEL 8 2.7.1-1.module+el8.6.0+12838+640e6226
  • python39 RHEL 8 3.9.16-1.module+el8.8.0+17625+b531f198

red hat advisories RHSA-2023:2764RHSA-2023:2763RHSA-2023:0833RHSA-2022:6766RHSA-2022:8353

  • python SLES 12 SP3-BCL, SLES 12 SP2-BCL 2.7.18-28.90.1
  • python-base SLES 12 SP3-BCL, SLES 12 SP2-BCL 2.7.18-28.90.1
  • python3 SLES 12 SP5, SLES 12 SP3-BCL, SLES 12 SP2-BCL +7 more 3.4.10-25.96.1
  • python3-base SLES 12 SP5, SLES 12 SP3-BCL, SLES 12 SP2-BCL +7 more 3.4.10-25.96.1
  • python SLES 15 SP2-BCL, SLES 15 SP1-BCL, SLE Module for Python 2 15 SP3 +21 more 2.7.18-150000.44.1
  • python-base SLES 15 SP2-BCL, SLES 15 SP1-BCL, SLE Module for Python 2 15 SP3 +20 more 2.7.18-150000.44.1
  • python3 SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +17 more 3.6.15-150000.3.109.1
  • python3-core SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +17 more 3.6.15-150000.3.109.1

suse advisories SUSE-SU-2022:3940-1SUSE-SU-2022:3511-2SUSE-SU-2022:3511-1SUSE-SU-2022:3512-2SUSE-SU-2022:3512-1SUSE-SU-2022:3593-1

  • python310 openSUSE Tumbleweed 3.10.6-3.1
  • python38 openSUSE Tumbleweed 3.8.13-4.1
  • python39 openSUSE Tumbleweed 3.9.13-5.1
  • python openSUSE Tumbleweed 2.7.18-23.1

opensuse advisories openSUSE-SU-2024:12297-1openSUSE-SU-2024:12300-1openSUSE-SU-2024:12301-1openSUSE-SU-2024:12321-1

  • python38 AlmaLinux 8 3.8.16-1.module_el8.8.0+3482+d5d93a3e
  • python38-py AlmaLinux 8 1.8.0-8.module_el8.6.0+2778+cd494b30
  • python38-pip AlmaLinux 8 19.3.1-6.module_el8.7.0+3344+99a6a656
  • python38-ply AlmaLinux 8 3.11-10.module_el8.6.0+2778+cd494b30
  • python38-six AlmaLinux 8 1.12.0-10.module_el8.6.0+2778+cd494b30
  • python38-cffi AlmaLinux 8 1.13.2-3.module_el8.6.0+2778+cd494b30
  • python38-cffi AlmaLinux 8 1.13.2-3.module_el8.6.0+3163+f4472775
  • python38-idle AlmaLinux 8 3.8.16-1.module_el8.8.0+3482+d5d93a3e

almalinux advisories ALSA-2023:2763ALSA-2023:2764ALSA-2023:0833ALSA-2022:8353

  • babel Rocky Linux 8 2.7.0-11.module+el8.9.0+1418+f0d66789
  • Cython Rocky Linux 8 0.29.14-4.module+el8.9.0+1418+f0d66789
  • pytest Rocky Linux 8 4.6.6-3.module+el8.9.0+1418+f0d66789
  • PyYAML Rocky Linux 8 5.4.1-1.module+el8.9.0+1418+f0d66789
  • PyYAML Rocky Linux 8 5.4.1-1.module+el8.10.0+1582+bc278001
  • PyYAML Rocky Linux 8 5.4.1-1.module+el8.10.0+1860+afcc1c71
  • python-py Rocky Linux 8 1.8.0-8.module+el8.9.0+1418+f0d66789
  • python-ply Rocky Linux 8 3.11-10.module+el8.9.0+1418+f0d66789

rocky linux advisories RLSA-2023:2763RLSA-2023:2764RLSA-2023:0833RLSA-2022:8353

  • python3 CBL-Mariner 2.0 3.9.19-1

azure linux advisories AZL-10618

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2021-28861 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-28861 updated cvss 7.4

python: open redirection vulnerability in lib/http/server.py may lead to information disclosure

  • Red Hat Enterprise Linux 7 python3, python3-idle, python3-libs, python3-test, python3-tkinter
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 pytz, babel, numpy, Cython, PyYAML, mod_wsgi, +57 more
    affected: no fix available
  • Red Hat CodeReady Linux Builder (v. 9) python3 3.9.14-1.el9, python3-idle 3.9.14-1.el9, python3-test 3.9.14-1.el9, python3-tkinter 3.9.14-1.el9
    fixed: vendor fix RHSA-2022:8353
  • Red Hat Enterprise Linux AppStream (v. 8) python3-idle 3.6.8-48.el8_7.1, python3-test 3.6.8-48.el8_7.1, platform-python 3.6.8-48.el8_7.1, python3-tkinter 3.6.8-48.el8_7.1, pytz 2019.3-3.module+el8.4.0+8888+89bc7e79, scipy 1.3.1-4.module+el8.4.0+8888+89bc7e79, +118 more
    fixed: vendor fix RHSA-2023:0833
  • Red Hat Enterprise Linux AppStream (v. 9) python3-tkinter 3.9.14-1.el9, python-unversioned-command 3.9.14-1.el9
    fixed: vendor fix RHSA-2022:8353
  • Red Hat Enterprise Linux BaseOS (v. 8) python3 3.6.8-48.el8_7.1, python3-libs 3.6.8-48.el8_7.1, python3-test 3.6.8-48.el8_7.1, platform-python 3.6.8-48.el8_7.1
    fixed: vendor fix RHSA-2023:0833
  • Red Hat Enterprise Linux BaseOS (v. 9) python3 3.9.14-1.el9, python3.9 3.9.14-1.el9, python3-libs 3.9.14-1.el9
    fixed: vendor fix RHSA-2022:8353
  • Red Hat Enterprise Linux CRB (v. 8) pytest 4.6.6-3.module+el8.4.0+8888+89bc7e79, pytest 6.0.2-2.module+el8.4.0+9822+20bf1249, Cython 0.29.21-5.module+el8.4.0+9822+20bf1249, pybind11 2.7.1-1.module+el8.6.0+12838+640e6226, python-py 1.8.0-8.module+el8.4.0+8888+89bc7e79, python-py 1.10.0-1.module+el8.4.0+9822+20bf1249, +34 more
    fixed: vendor fix RHSA-2023:2763
show 2 more
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python 3.8.14-1.el7, rh-python38-python-idle 3.8.14-1.el7, rh-python38-python-libs 3.8.14-1.el7, rh-python38-python-test 3.8.14-1.el7, rh-python38-python-tkinter 3.8.14-1.el7, rh-python38-python-rpm-macros 3.8.14-1.el7, +1 more Red Hat Software Collections for RHEL(v. 7) rh-python38-python 3.8.14-1.el7, rh-python38-python-idle 3.8.14-1.el7, rh-python38-python-libs 3.8.14-1.el7, rh-python38-python-test 3.8.14-1.el7, rh-python38-python-tkinter 3.8.14-1.el7, rh-python38-python-rpm-macros 3.8.14-1.el7, +1 more
    fixed: vendor fix RHSA-2022:6766
  • Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 8 scipy, python2, python36, python-nose, python-wheel, python2-libs, +24 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 7.4

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2y ago

Exploit prediction

2.84% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
OSV 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
bitnami libpython
>=3.0.0, <3.7.14
>=3.8.0, <3.8.14
>=3.9.0, <3.9.14
>=3.10.0, <3.10.6
3.7.14
3.8.14
3.9.14
3.10.6
bitnami python
>=3.0.0, <3.7.14
>=3.8.0, <3.8.14
>=3.9.0, <3.9.14
>=3.10.0, <3.10.6
3.7.14
3.8.14
3.9.14
3.10.6
bitnami python-min
>=3.0.0, <3.7.14
>=3.8.0, <3.8.14
>=3.9.0, <3.9.14
>=3.10.0, <3.10.6
3.7.14
3.8.14
3.9.14
3.10.6

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.