Regular Expression Denial of Service (ReDoS) Vulnerability in Python 2.7 Package
Summary
DEBIAN-CVE-2020-8492: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of... Affects python2.7 versions < 2.7.18-2. Fixed in 2.7.18-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 2.7 is a widely used programming language known for its simplicity and versatility. It is part of the Python ecosystem, which includes various libraries and frameworks that facilitate web development, data analysis, artificial intelligence, and more. The vulnerability in question affects versions of Python 2.7 up to 2.7.17, allowing an HTTP server to exploit a flaw in the urllib.request.AbstractBasicAuthHandler, leading to potential Denial of Service (DoS) attacks against clients.
Vulnerability Detail
The vulnerability arises from a flaw in the way Python handles regular expressions in the AbstractBasicAuthHandler. Specifically, it allows an attacker to craft a request that causes catastrophic backtracking in the regular expression engine. This can lead to excessive CPU usage and ultimately a Denial of Service for legitimate users, as the server becomes unresponsive due to the resource exhaustion.
How To Fix
Minimum fixed version
2.7.18-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing rate limiting on your HTTP server to mitigate the impact of potential ReDoS attacks. This can help prevent excessive resource consumption by limiting the number of requests from a single client.
Conclusion
The vulnerability identified in Python 2.7 poses a significant risk of Denial of Service attacks through regular expression exploitation. Users are strongly encouraged to update to the patched version to mitigate this risk. Implementing rate limiting can serve as a temporary measure until the update is applied.
See every vulnerability recorded for python2.7 →
FAQ
A ReDoS attack exploits vulnerabilities in regular expression processing to cause excessive backtracking, leading to high CPU usage and potential service outages.
Python versions 2.7 through 2.7.17, as well as several other versions of Python 3, are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing rate limiting on your server to reduce the risk of a ReDoS attack.
Yes, Vulert provides a service that monitors open-source vulnerabilities in your software using a manifest file like package-lock.json, alerting you in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
