diff options
| author | Victor Stinner <vstinner@python.org> | 2020-06-20 06:26:58 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-06-20 06:26:58 (GMT) |
| commit | 37fe316479e0b6906a74b0c0a5e495c55037fdfd (patch) | |
| tree | 8c28e5c58d863034fdab90f35820290d58822a10 /Python/Python-ast.c | |
| parent | f91a0b6df14d6c5133fe3d5889fad7d84fc0c046 (diff) | |
| download | cpython-37fe316479e0b6906a74b0c0a5e495c55037fdfd.zip cpython-37fe316479e0b6906a74b0c0a5e495c55037fdfd.tar.gz cpython-37fe316479e0b6906a74b0c0a5e495c55037fdfd.tar.bz2 | |
bpo-39503: CVE-2020-8492: Fix AbstractBasicAuthHandler (GH-18284) (#19305)
The AbstractBasicAuthHandler class of the urllib.request module uses
an inefficient regular expression which can be exploited by an
attacker to cause a denial of service. Fix the regex to prevent the
catastrophic backtracking. Vulnerability reported by Ben Caller
and Matt Schwager.
AbstractBasicAuthHandler of urllib.request now parses all
WWW-Authenticate HTTP headers and accepts multiple challenges per
header: use the realm of the first Basic challenge.
Diffstat (limited to 'Python/Python-ast.c')
0 files changed, 0 insertions, 0 deletions