Regular Expression Denial of Service (REDoS) in httplib2
概要
Regular Expression Denial of Service (REDoS) in httplib2
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Impact
A malicious server which responds with long series of \xa0 characters in the www-authenticate header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.
Patches
Version 0.19.0 contains new implementation of auth headers parsing, using pyparsing library.
https://github.com/httplib2/httplib2/pull/182
Workarounds
import httplib2
httplib2.USE_WWW_AUTH_STRICT_PARSING = True
Technical Details
The vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/__init__.py#L336-L338
The section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:
\s*[^ \t\r\n=]+\s*=
Since all three infinitely repeating groups accept the non-breaking space character \xa0, a long string of \xa0 causes catastrophic backtracking.
The complexity is cubic, so doubling the length of the malicious string of \xa0 makes processing take 8 times as long.
Reproduction Steps
Run a malicious server which responds with
www-authenticate: x \xa0\xa0\xa0\xa0x
but with many more \xa0 characters.
An example malicious python server is below:
from http.server import BaseHTTPRequestHandler, HTTPServer
def make_header_value(n_spaces):
repeat = "\xa0" * n_spaces
return f"x {repeat}x"
class Handler(BaseHTTPRequestHandler):
def do_GET(self):
self.…
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2021-21240 python-httplib2 修正版: 0.20.2-1
- Ubuntu UBUNTU-CVE-2021-21240 python-httplib2
参照URL
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web pypi.org