Regular Expression Denial of Service in Python Bleach Package
Summary
CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Affects python-bleach across 2 version ranges.
< 3.1.4-1
< 6e74a5027b57055cdaeb040343d32934121392a7
Fixed in 3.1.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python Bleach is a popular library used for sanitizing HTML and preventing XSS attacks by allowing only certain tags and attributes. It is widely utilized in web applications to ensure user-generated content is safe for rendering. However, a vulnerability has been identified in its handling of style attributes, which could lead to performance degradation under certain conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2020-6817, arises from the way bleach.clean processes style attributes. When an allowed tag is accompanied by an allowed style attribute, it can lead to a Regular Expression Denial of Service (ReDoS). This occurs because the regex used for parsing can be exploited with specially crafted input, causing excessive backtracking and ultimately leading to a denial of service. The severity of this vulnerability is rated with a CVSS score of 7.5, indicating a high risk to applications that utilize this library without proper safeguards.
How To Fix
Minimum fixed version
3.1.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-bleachTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid allowing style attributes in your bleach.clean calls. Instead, you can sanitize input without style attributes by modifying your code as follows:
bleach.clean(input_data, attributes={'a': []})
This will prevent the vulnerability from being exploited while you work on upgrading the package.
Conclusion
The CVE-2020-6817 vulnerability in the Python Bleach package poses a significant risk due to its potential for causing denial of service through regex exploitation. It is crucial for developers to upgrade to the fixed version or implement workarounds to mitigate the risk. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for python-bleach →
FAQ
CVE-2020-6817 is a vulnerability in the Python Bleach package that allows for Regular Expression Denial of Service (ReDoS) when processing style attributes.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your manifest file.
The CVSS score for CVE-2020-6817 is 7.5, indicating a high severity level.
If an immediate upgrade is not possible, implement the provided workaround by disallowing style attributes in your bleach.clean calls.
More information can be found in the official CVE database or by visiting the GitHub repository for the Bleach project.
Related vulnerabilities
Recent vulnerabilities recorded for python-bleach.
