Victor Stinner 0b297d4ff1 bpo-39503: CVE-2020-8492: Fix AbstractBasicAuthHandler (GH-18284) ... The AbstractBasicAuthHandler class of the urllib.request module uses an inefficient regular expression which can be exploited by an attacker to cause a denial of service. Fix the regex to prevent the catastrophic backtracking. Vulnerability reported by Ben Caller and Matt Schwager. AbstractBasicAuthHandler of urllib.request now parses all WWW-Authenticate HTTP headers and accepts multiple challenges per header: use the realm of the first Basic challenge. Co-Authored-By: Serhiy Storchaka <storchaka@gmail.com>		2020-04-02 02:52:20 +02:00
..
__init__.py	…
error.py	bpo-30022: Get rid of using EnvironmentError and IOError (except test… (#1051)	2017-04-16 10:46:38 +03:00
parse.py	bpo-37970: update and improve urlparse and urlsplit doc-strings (GH-16458)	2020-02-16 21:17:58 +02:00
request.py	bpo-39503: CVE-2020-8492: Fix AbstractBasicAuthHandler (GH-18284)	2020-04-02 02:52:20 +02:00
response.py	bpo-12707: deprecate info(), geturl(), getcode() methods in favor of headers, url, and status properties for HTTPResponse and addinfourl (GH-11447)	2019-09-13 12:40:07 +01:00
robotparser.py	bpo-35922: Fix RobotFileParser when robots.txt has no relevant crawl delay or request rate (GH-11791)	2019-06-16 09:48:57 +03:00