There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Ubuntu:Pro:14.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-8ubuntu0.6+esm20"}]}]

Ubuntu:Pro:14.04:LTS python3.5

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.4~14.04.1+esm3"}]}]

Ubuntu:Pro:14.04:LTS python3.4

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:16.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.12-1ubuntu0~16.04.18+esm10"}]}]

Ubuntu:Pro:16.04:LTS python3.5

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.2-2ubuntu0~16.04.13+esm14"}]}]

Ubuntu:Pro:18.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.17-1~18.04ubuntu1.13+esm5"}]}]

Ubuntu:Pro:18.04:LTS python3.6

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:18.04:LTS python3.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:Pro:18.04:LTS python3.8

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:20.04:LTS python3.8

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.10-0ubuntu1~20.04.12"}]}]

Ubuntu:Pro:20.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-1~20.04.4+esm2"}]}]

Ubuntu:Pro:20.04:LTS python3.9

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:22.04:LTS python3.10

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.12-1~22.04.6"}]}]

Ubuntu:Pro:22.04:LTS python2.7

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-13ubuntu1.2+esm2"}]}]

Ubuntu:Pro:22.04:LTS python3.11

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:24.04:LTS python3.12

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.3-1ubuntu0.2"}]}]

参照URL

advisory ubuntu.com
advisory ubuntu.com
report ubuntu.com
report cve.org
report github.com
report mail.python.org