Regular Expression Denial of Service (ReDoS) Vulnerability in Python Packages
Summary
UBUNTU-CVE-2020-8492: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of... Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm5. Fixed in 2.7.6-8ubuntu0.6+esm5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is extensively utilized in web development, data analysis, artificial intelligence, and more. The affected packages, including python2.7, python3.4, python3.5, python3.6, python3.7, and python3.8, are integral to many applications, providing essential functionalities for executing Python code. However, these packages are vulnerable to a Regular Expression Denial of Service (ReDoS) attack, which can severely impact applications relying on them.
Vulnerability Detail
The vulnerability arises from the way certain Python versions handle regular expressions in HTTP requests. Specifically, versions 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allow an HTTP server to exploit catastrophic backtracking in the urllib.request.AbstractBasicAuthHandler. This can lead to a denial of service, where the server becomes unresponsive due to excessive resource consumption. Attackers can craft specific requests that trigger this behavior, potentially leading to service outages and degraded performance.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to limit the complexity of regular expressions processed by your application. Additionally, avoid using vulnerable versions of Python for critical applications until they can be updated.
Conclusion
The Regular Expression Denial of Service vulnerability in various Python packages poses a significant risk to applications relying on these versions. It is essential to update to the patched versions to ensure the security and stability of your applications. Regular monitoring and proactive measures can help mitigate the risks associated with such vulnerabilities.
See every vulnerability recorded for python2.7 →
FAQ
A ReDoS attack exploits the way regular expressions are processed, causing excessive backtracking that can lead to application slowdowns or crashes.
The affected versions include Python 2.7 (up to 2.7.17), Python 3.5 (up to 3.5.9), Python 3.6 (up to 3.6.10), Python 3.7 (up to 3.7.6), and Python 3.8 (up to 3.8.1).
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement input validation and limit the complexity of regular expressions to mitigate potential attacks.
The CVSS score for this vulnerability is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
