Denial of Service Vulnerability in Python 2.7: Memory Consumption via gzip_decode Function
Summary
DEBIAN-CVE-2013-1753: The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request. Affects python2.7 versions < 2.7.9-1. Fixed in 2.7.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 2.7 is a widely-used programming language known for its simplicity and versatility. It is utilized in various applications, from web development to data analysis. The xmlrpc client library in Python 2.7 allows for remote procedure calls, enabling communication between different systems. However, this library has a vulnerability in the gzip_decode function that can be exploited, leading to memory consumption issues.
Vulnerability Detail
The vulnerability arises from the gzip_decode function in the xmlrpc client library of Python 2.7, which is susceptible to crafted HTTP requests. Attackers can exploit this flaw to cause a denial of service by consuming excessive memory resources. This can lead to application crashes or slowdowns, impacting the availability of services relying on this library. The issue affects Python versions 3.4 and earlier, making it critical for users of these versions to address it promptly.
How To Fix
Minimum fixed version
2.7.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to filter out potentially malicious HTTP requests before they reach the gzip_decode function. This can help mitigate the risk of memory consumption until the package is updated.
Conclusion
The vulnerability in the gzip_decode function of Python 2.7 poses a significant risk of denial of service through memory consumption. Users are strongly advised to update to the patched version 2.7.9-1 to protect their applications. Implementing temporary workarounds can help mitigate risks until an update is feasible.
See every vulnerability recorded for python2.7 →
FAQ
The vulnerability can lead to denial of service due to excessive memory consumption, potentially crashing applications that rely on the affected library.
The vulnerability affects Python 3.4 and earlier versions, specifically in the gzip_decode function of the xmlrpc client library.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring installation.
Yes, the patched version of Python 2.7 is 2.7.9-1. Updating to this version will resolve the vulnerability.
If an immediate update is not possible, implement input validation as a temporary workaround to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
