NotificationsYou must be signed in to change notification settings
Fork33.4k
Star69.8k

[2.7] bpo-32981: Fix catastrophic backtracking vulns (GH-5955)#5970

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

benjaminp merged 1 commit into2.7frombackport-0e6c8ee-2.7

Mar 4, 2018

Merged

[2.7] bpo-32981: Fix catastrophic backtracking vulns (GH-5955)#5970

benjaminp merged 1 commit into2.7frombackport-0e6c8ee-2.7

Mar 4, 2018

Conversation

Copy link

Contributor

benjaminp commentedMar 4, 2018•
edited by bedevere-bot
Loading

Prevent low-grade poplib REDOS (CVE-2018-1060)

The regex to test a mail server's timestamp is susceptible to
catastrophic backtracking on long evil responses from the server.

Happily, the maximum length of malicious inputs is 2K thanks
to a limit introduced in the fix for CVE-2013-1752.

A 2KB evil response from the mail server would result in small slowdowns
(milliseconds vs. microseconds) accumulated over many apop calls.
This is a potential DOS vector via accumulated slowdowns.

Replace it with a similar non-vulnerable regex.

The new regex is RFC compliant.
The old regex was non-compliant in edge cases.

Prevent difflib REDOS (CVE-2018-1061)

The default regex for IS_LINE_JUNK is susceptible to
catastrophic backtracking.
This is a potential DOS vector.

Replace it with an equivalent non-vulnerable regex.

Also introduce unit and REDOS tests for difflib.

Co-authored-by: Tim Peterstim.peters@gmail.com
Co-authored-by: Christian Heimeschristian@python.org.
(cherry picked from commit0e6c8ee)

https://bugs.python.org/issue32981

[2.7]bpo-32981: Fix catastrophic backtracking vulns (GH-5955)

24db3ee

* Prevent low-grade poplib REDOS (CVE-2018-1060)The regex to test a mail server's timestamp is susceptible tocatastrophic backtracking on long evil responses from the server.Happily, the maximum length of malicious inputs is 2K thanksto a limit introduced in the fix for CVE-2013-1752.A 2KB evil response from the mail server would result in small slowdowns(milliseconds vs. microseconds) accumulated over many apop calls.This is a potential DOS vector via accumulated slowdowns.Replace it with a similar non-vulnerable regex.The new regex is RFC compliant.The old regex was non-compliant in edge cases.* Prevent difflib REDOS (CVE-2018-1061)The default regex for IS_LINE_JUNK is susceptible tocatastrophic backtracking.This is a potential DOS vector.Replace it with an equivalent non-vulnerable regex.Also introduce unit and REDOS tests for difflib.Co-authored-by: Tim Peters <tim.peters@gmail.com>Co-authored-by: Christian Heimes <christian@python.org>.(cherry picked from commit0e6c8ee)