Regular Expression Denial of Service (ReDoS) in Python
Summary
CVE-2020-8492: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of... Affects python3 across 6 version ranges.
>= 1bf9cc509326bc42cd8cb1650eb9bf64550d817e, <= 43364a7ae01fbe4288ef42622259a0038ce1edcc
>= 2e789a1f1d84b343a996e8654590703b5fbdd441, <= e5f6aba872e66bfd86eb592214696a519cded197
< 3.7.7-r0
>= 5c4568a05a0a62b5947c55f68f9f2ecfb90a4f12, <= 02dff8b01100e7cd6d4c93be27202ccb4ea05811
< c2f86d86e6c8f5fd1ef602128b537a48f3f5c063
>= fa919fdf2583bdfead1df00e842f24f30b2a34bf, <= 1b293b60067f6f4a95984d064ce0f6b6d34c1216
Fixed in 3.7.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a popular programming language known for its simplicity and versatility. It is widely used for web development, data analysis, artificial intelligence, and more. The Python Standard Library includes various modules and packages that provide additional functionality. One such package is urllib, which allows Python programs to make HTTP requests. However, versions 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 of Python are vulnerable to a Regular Expression Denial of Service (ReDoS) attack when using urllib.request.AbstractBasicAuthHandler.
Vulnerability Detail
The vulnerability (CVE-2020-8492) arises due to catastrophic backtracking in the AbstractBasicAuthHandler class of urllib.request. An attacker can exploit this vulnerability by sending a specially crafted HTTP request, causing the server to perform excessive backtracking during regular expression matching. This can lead to a denial of service (DoS) condition, where the server becomes unresponsive or crashes. The impact of this vulnerability can be severe, especially if the affected server is critical to an organization's operations.
How To Fix
Minimum fixed version
3.7.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can consider implementing rate limiting or request validation mechanisms on the server-side to mitigate the impact of potential DoS attacks. Additionally, using a web application firewall (WAF) can help detect and block malicious requests that exploit this vulnerability.
Conclusion
Regular Expression Denial of Service (ReDoS) is a critical vulnerability in Python versions 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1. It allows an attacker to perform a denial of service attack by exploiting the catastrophic backtracking in urllib.request.AbstractBasicAuthHandler. To mitigate this vulnerability, it is crucial to update Python to a fixed version and consider implementing additional security measures. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3 →
FAQ
A Regular Expression Denial of Service (ReDoS) attack is a type of denial of service attack that targets regular expression implementations. It exploits the exponential time complexity of certain regular expressions, causing the matching process to take an excessive amount of time and resources.
You can use the Vulert playground (https://vulert.com/scanner) to check if your Python installation is affected by this vulnerability. Vulert analyzes package-lock.json files to identify and alert about open-source vulnerabilities in software.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is essential to patch your Python installation to prevent potential attacks.
Yes, this vulnerability can be exploited remotely. An attacker can send a malicious HTTP request to a vulnerable server, triggering the excessive backtracking and causing a denial of service condition.
There is no evidence of active exploitation of this vulnerability at the time of this report. However, it is crucial to apply the necessary patches and updates to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for python3.
