Regular Expression Denial of Service (ReDoS) Vulnerability in Python3 Package
Summary
ALPINE-CVE-2020-8492: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of... Affects python3 versions < 3.7.7-r0. Fixed in 3.7.7-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python3 package is a widely used programming language that enables developers to create a variety of applications, from web development to data analysis. It is known for its simplicity and readability, making it a popular choice among both beginners and experienced programmers. However, certain versions of Python3 are vulnerable to a Regular Expression Denial of Service (ReDoS) attack due to issues in the urllib.request.AbstractBasicAuthHandler component, which can lead to catastrophic backtracking during HTTP requests.
Vulnerability Detail
The vulnerability identified as CVE-2020-8492 affects Python versions 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1. It allows an attacker to exploit the HTTP server's handling of requests, leading to a denial of service for clients. This occurs due to inefficient regular expression processing, which can cause the server to hang or crash when faced with specially crafted input, resulting in significant service disruption.
How To Fix
Minimum fixed version
3.7.7-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize user inputs before processing them with regular expressions. This can help mitigate the risk of ReDoS attacks by preventing malicious patterns from being executed.
Conclusion
The CVE-2020-8492 vulnerability in the Python3 package poses a significant risk of denial of service through ReDoS attacks. It is crucial for users to update their packages to the latest patched versions to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until updates are applied.
See every vulnerability recorded for python3 →
FAQ
A ReDoS attack exploits the way regular expressions are processed, causing the server to consume excessive resources and potentially crash.
The vulnerability affects Python versions 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signing up.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
Implement input validation to sanitize user inputs and prevent potential ReDoS attacks until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
