Regular Expression Denial of Service in Python-Bleach: CVE-2020-6817
Summary
DEBIAN-CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Affects python-bleach versions < 3.1.4-1. Fixed in 3.1.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Bleach is a popular HTML sanitizing library used in Python applications to clean up and filter HTML content. It allows developers to specify which tags and attributes are permitted, ensuring that user-generated content is safe for rendering in web applications. However, a vulnerability has been identified in the way bleach.clean processes style attributes, which could lead to performance degradation through regular expression denial of service (ReDoS) attacks.
Vulnerability Detail
The vulnerability arises from the bleach.clean function's handling of style attributes in allowed tags. When an allowed tag is used with an allowed style attribute, it can be exploited to cause excessive backtracking in regular expressions, leading to a denial of service. This means that an attacker could craft specific input that would cause the application to hang or crash, significantly affecting the availability of the service.
How To Fix
Minimum fixed version
3.1.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-bleachTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using style attributes in the allowed tags when calling bleach.clean. For example, instead of allowing style attributes, you can restrict the allowed attributes to only those that are necessary for your application, like this: bleach.clean(html_content, attributes={'a': []}).
Conclusion
In summary, CVE-2020-6817 is a significant vulnerability in the Python-Bleach library that can lead to denial of service attacks. It is crucial for developers using this library to update to the patched version or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for python-bleach →
FAQ
CVE-2020-6817 is a vulnerability in the Python-Bleach library that allows for regular expression denial of service (ReDoS) attacks through improper handling of style attributes.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any installation.
If exploited, this vulnerability can lead to service outages as the application may hang or crash due to excessive resource consumption caused by crafted input.
Yes, a patch is available in version 3.1.4-1 of the python-bleach package. Updating to this version will resolve the vulnerability.
If you cannot update the package right away, consider implementing the workaround by avoiding the use of style attributes in your bleach.clean calls.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-bleach.
