summaryrefslogtreecommitdiffstats
path: root/Misc/NEWS.d/next/Security
Commit message (Collapse)AuthorAgeFilesLines
* bpo-37228: Fix loop.create_datagram_endpoint()'s usage of SO_REUSEADDR (#17311)Kyle Stanley2019-12-091-0/+6
|
* bpo-38945: UU Encoding: Don't let newline in filename corrupt the output ↵Matthew Rollings2019-12-021-0/+1
| | | | format (#17418)
* bpo-38804: Fix REDoS in http.cookiejar (GH-17157)bcaller2019-11-221-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular expression denial of service (REDoS). LOOSE_HTTP_DATE_RE.match is called when using http.cookiejar.CookieJar to parse Set-Cookie headers returned by a server. Processing a response from a malicious HTTP server can lead to extreme CPU usage and execution will be blocked for a long time. The regex contained multiple overlapping \s* capture groups. Ignoring the ?-optional capture groups the regex could be simplified to \d+-\w+-\d+(\s*\s*\s*)$ Therefore, a long sequence of spaces can trigger bad performance. Matching a malicious string such as LOOSE_HTTP_DATE_RE.match("1-c-1" + (" " * 2000) + "!") caused catastrophic backtracking. The fix removes ambiguity about which \s* should match a particular space. You can create a malicious server which responds with Set-Cookie headers to attack all python programs which access it e.g. from http.server import BaseHTTPRequestHandler, HTTPServer def make_set_cookie_value(n_spaces): spaces = " " * n_spaces expiry = f"1-c-1{spaces}!" return f"b;Expires={expiry}" class Handler(BaseHTTPRequestHandler): def do_GET(self): self.log_request(204) self.send_response_only(204) # Don't bother sending Server and Date n_spaces = ( int(self.path[1:]) # Can GET e.g. /100 to test shorter sequences if len(self.path) > 1 else 65506 # Max header line length 65536 ) value = make_set_cookie_value(n_spaces) for i in range(99): # Not necessary, but we can have up to 100 header lines self.send_header("Set-Cookie", value) self.end_headers() if __name__ == "__main__": HTTPServer(("", 44020), Handler).serve_forever() This server returns 99 Set-Cookie headers. Each has 65506 spaces. Extracting the cookies will pretty much never complete. Vulnerable client using the example at the bottom of https://docs.python.org/3/library/http.cookiejar.html : import http.cookiejar, urllib.request cj = http.cookiejar.CookieJar() opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) r = opener.open("http://localhost:44020/") The popular requests library was also vulnerable without any additional options (as it uses http.cookiejar by default): import requests requests.get("http://localhost:44020/") * Regression test for http.cookiejar REDoS If we regress, this test will take a very long time. * Improve performance of http.cookiejar.ISO_DATE_RE A string like "444444" + (" " * 2000) + "A" could cause poor performance due to the 2 overlapping \s* groups, although this is not as serious as the REDoS in LOOSE_HTTP_DATE_RE was.
* Python 3.9.0a1v3.9.0a1Łukasz Langa2019-11-1913-26/+0
|
* bpo-38622: Add missing audit events for ctypes module (GH-17158)Steve Dower2019-11-181-0/+1
|
* bpo-38722: Runpy use io.open_code() (GH-17234)jsnklln2019-11-181-0/+2
| | | | | | | https://bugs.python.org/issue38722 Automerge-Triggered-By: @taleinat
* bpo-38418: Fixes audit event for os.system to be named 'os.system' (GH-16670)Steve Dower2019-10-181-0/+1
| | | | | | | https://bugs.python.org/issue38418 Automerge-Triggered-By: @zooba
* bpo-38243, xmlrpc.server: Escape the server_title (GH-16373)Dong-hee Na2019-09-271-0/+3
| | | | Escape the server title of xmlrpc.server.DocXMLRPCServer when rendering the document page as HTML.
* closes bpo-38174: Update vendored expat library to 2.2.8. (GH-16346)Benjamin Peterson2019-09-261-0/+2
| | | Fixes CVE-2019-15903. See full changelog at https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes.
* bpo-37764: Fix infinite loop when parsing unstructured email headers. (GH-15239)Ashwin Ramaswami2019-08-311-0/+1
| | | | | | | | | | | | Fixes a case in which email._header_value_parser.get_unstructured hangs the system for some invalid headers. This covers the cases in which the header contains either: - a case without trailing whitespace - an invalid encoded word https://bugs.python.org/issue37764 This fix should also be backported to 3.7 and 3.8 https://bugs.python.org/issue37764
* Fix typos in comments, docs and test names (#15018)Min ho Kim2019-07-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | * Fix typos in comments, docs and test names * Update test_pyparse.py account for change in string length * Apply suggestion: splitable -> splittable Co-Authored-By: Terry Jan Reedy <tjreedy@udel.edu> * Apply suggestion: splitable -> splittable Co-Authored-By: Terry Jan Reedy <tjreedy@udel.edu> * Apply suggestion: Dealloccte -> Deallocate Co-Authored-By: Terry Jan Reedy <tjreedy@udel.edu> * Update posixmodule checksum. * Reverse idlelib changes.
* bpo-34155: Dont parse domains containing @ (GH-13079)jpic2019-07-171-0/+1
| | | | | | | | | | | | | | | | | | | | | | Before: >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses (Address(display_name='', username='a', domain='malicious.org'),) >>> parseaddr('a@malicious.org@important.com') ('', 'a@malicious.org') After: >>> email.message_from_string('From: a@malicious.org@important.com', policy=email.policy.default)['from'].addresses (Address(display_name='', username='', domain=''),) >>> parseaddr('a@malicious.org@important.com') ('', 'a@') https://bugs.python.org/issue34155
* bpo-37461: Fix infinite loop in parsing of specially crafted email headers ↵Abhilash Raj2019-07-171-0/+2
| | | | | | | | | | (GH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop.
* bpo-37463: match_hostname requires quad-dotted IPv4 (GH-14499)Christian Heimes2019-07-021-0/+4
| | | | | | | | | | | | | | | | ssl.match_hostname() no longer accepts IPv4 addresses with additional text after the address and only quad-dotted notation without trailing whitespaces. Some inet_aton() implementations ignore whitespace and all data after whitespace, e.g. '127.0.0.1 whatever'. Short notations like '127.1' for '127.0.0.1' were already filtered out. The bug was initially found by Dominik Czarnota and reported by Paul Kehrer. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue37463
* bpo-37363: Add audit events on startup for the run commands (GH-14524)Steve Dower2019-07-011-0/+2
|
* bpo-37363: Add audit events for a range of modules (GH-14301)Steve Dower2019-06-241-0/+5
|
* bpo-37364: Use io.open_code() to read .pth files (GH-14299)Steve Dower2019-06-211-0/+1
| | | https://bugs.python.org/issue37364
* bpo-34631: Updated OpenSSL to 1.1.1c in Windows installer (GH-14163)Steve Dower2019-06-171-0/+1
|
* Python 3.8.0b1v3.8.0b1Łukasz Langa2019-06-043-6/+0
|
* bpo-35907: Fix typo in the NEWS entry (GH-13559)Victor Stinner2019-05-241-1/+1
|
* bpo-35907: Clarify the NEWS entry (GH-13523)Victor Stinner2019-05-241-2/+3
|
* bpo-33164: update blake2 implementation (GH-6286)David Carlier2019-05-231-0/+1
|
* bpo-35907, CVE-2019-9948: urllib rejects local_file:// scheme (GH-13474)Victor Stinner2019-05-221-0/+2
| | | | | | | CVE-2019-9948: Avoid file reading as disallowing the unnecessary URL scheme in URLopener().open() and URLopener().retrieve() of urllib.request. Co-Authored-By: SH <push0ebp@gmail.com>
* bpo-33529, email: Fix infinite loop in email header encoding (GH-12020)Krzysztof Wojcik2019-05-141-0/+2
|
* Python 3.8.0a4v3.8.0a4Łukasz Langa2019-05-063-7/+0
|
* bpo-30458: Use InvalidURL instead of ValueError. (GH-13044)Gregory P. Smith2019-05-011-1/+1
| | | Use http.client.InvalidURL instead of ValueError as the new error case's exception.
* bpo-30458: Disallow control chars in http URLs. (GH-12755)Gregory P. Smith2019-05-011-0/+1
| | | Disallow control chars in http URLs in urllib.urlopen. This addresses a potential security problem for applications that do not sanity check their URLs where http request headers could be injected.
* bpo-36742: Fixes handling of pre-normalization characters in urlsplit() ↵Steve Dower2019-04-301-0/+1
| | | | (GH-13017)
* bpo-35755: Remove current directory from posixpath.defpath (GH-11586)Victor Stinner2019-04-171-0/+5
| | | Document the change in a NEWS entry of the Security category.
* v3.8.0a3v3.8.0a3Łukasz Langa2019-03-252-7/+0
|
* bpo-35121: prefix dot in domain for proper subdomain validation (GH-10258)Xtreak2019-03-101-0/+4
| | | Don't send cookies of domain A without Domain attribute to domain B when domain A is a suffix match of domain B while using a cookiejar with `http.cookiejar.DefaultCookiePolicy` policy. Patch by Karthikeyan Singaravelan.
* bpo-36216: Add check for characters in netloc that normalize to separators ↵Steve Dower2019-03-071-0/+3
| | | | (GH-12201)
* [blurb] v3.8.0a1Łukasz Langa2019-02-0312-29/+0
|
* bpo-35746: Fix segfault in ssl's cert parser (GH-11569)Christian Heimes2019-01-151-0/+3
| | | | | | | | | | | Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL distribution points with empty DP or URI correctly. A malicious or buggy certificate can result into segfault. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue35746
* bpo-34812: subprocess._args_from_interpreter_flags(): add isolated (GH-10675)Victor Stinner2018-11-231-0/+4
| | | | | | | | The "-I" command line option (run Python in isolated mode) is now also copied by the multiprocessing and distutils modules when spawning child processes. Previously, only -E and -s options (enabled by -I) were copied. subprocess._args_from_interpreter_flags() now copies the -I flag.
* bpo-34791: xml package obeys ignore env flags (GH-9544)Christian Heimes2018-09-241-0/+3
| | | | | | | | | | The xml.sax and xml.dom.domreg modules now obey sys.flags.ignore_environment. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue34791
* bpo-17239: Disable external entities in SAX parser (GH-9217)Christian Heimes2018-09-231-0/+3
| | | | | | | | | | | | The SAX parser no longer processes general external entities by default to increase security. Before, the parser created network connections to fetch remote files or loaded local files from the file system for DTD and entities. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue17239
* bpo-34623: Mention CVE-2018-14647 in news entry (GH-9482)Christian Heimes2018-09-221-2/+2
| | | https://bugs.python.org/issue34623
* bpo-34623: Use XML_SetHashSalt in _elementtree (GH-9146)Christian Heimes2018-09-181-0/+2
| | | | | | | | | | The C accelerated _elementtree module now initializes hash randomization salt from _Py_HashSecret instead of libexpat's default CPRNG. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue34623
* bpo-32533: Fixed thread-safety of error handling in _ssl. (GH-7158)Steve Dower2018-09-171-0/+1
|
* bpo-34405: Updated to OpenSSL 1.1.0i for Windows builds. (GH-8775)Steve Dower2018-08-151-0/+1
|
* bpo-33871: Fix os.sendfile(), os.writev(), os.readv(), etc. (GH-7931)Serhiy Storchaka2018-07-311-0/+3
| | | | | | | | | | | | * Fix integer overflow in os.readv(), os.writev(), os.preadv() and os.pwritev() and in os.sendfile() with headers or trailers arguments (on BSD-based OSes and MacOS). * Fix sending the part of the file in os.sendfile() on MacOS. Using the trailers argument could cause sending more bytes from the input file than was specified. Thanks Ned Deily for testing on 32-bit MacOS.
* bpo-33136: Harden ssl module against CVE-2018-8970 (GH-6229)Christian Heimes2018-03-251-0/+3
| | | | | | | Harden ssl module against LibreSSL CVE-2018-8970. X509_VERIFY_PARAM_set1_host() is called with an explicit namelen. A new test ensures that NULL bytes are not allowed. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-33001: Prevent buffer overrun in os.symlink (GH-5989)Steve Dower2018-03-051-0/+1
|
* bpo-32981: Fix catastrophic backtracking vulns (#5955)Jamie Davis2018-03-041-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Prevent low-grade poplib REDOS (CVE-2018-1060) The regex to test a mail server's timestamp is susceptible to catastrophic backtracking on long evil responses from the server. Happily, the maximum length of malicious inputs is 2K thanks to a limit introduced in the fix for CVE-2013-1752. A 2KB evil response from the mail server would result in small slowdowns (milliseconds vs. microseconds) accumulated over many apop calls. This is a potential DOS vector via accumulated slowdowns. Replace it with a similar non-vulnerable regex. The new regex is RFC compliant. The old regex was non-compliant in edge cases. * Prevent difflib REDOS (CVE-2018-1061) The default regex for IS_LINE_JUNK is susceptible to catastrophic backtracking. This is a potential DOS vector. Replace it with an equivalent non-vulnerable regex. Also introduce unit and REDOS tests for difflib. Co-authored-by: Tim Peters <tim.peters@gmail.com> Co-authored-by: Christian Heimes <christian@python.org>
* [bpo-28414] Make all hostnames in SSL module IDN A-labels (GH-5128)Christian Heimes2018-02-241-0/+1
| | | | | | | | | | | | Previously, the ssl module stored international domain names (IDNs) as U-labels. This is problematic for a number of reasons -- for example, it made it impossible for users to use a different version of IDNA than the one built into Python. After this change, we always convert to A-labels as soon as possible, and use them for all internal processing. In particular, server_hostname attribute is now an A-label, and on the server side there's a new sni_callback that receives the SNI servername as an A-label rather than a U-label.
* Update PyDoc topics and NEWS blurbs for 3.7.0a1Ned Deily2017-09-197-30/+0
|
* bpo-29505: Add fuzz tests for float(str), int(str), unicode(str) (#2878)Devin Jeanpierre2017-09-061-0/+1
| | | | | | | | | | | | | | | | | | | | | | Add basic fuzz tests for a few common builtin functions. This is an easy place to start, and these functions are probably safe. We'll want to add more fuzz tests later. Lets bootstrap using these. While the fuzz tests are included in CPython and compiled / tested on a very basic level inside CPython itself, the actual fuzzing happens as part of oss-fuzz (https://github.com/google/oss-fuzz). The reason to include the tests in CPython is to make sure that they're maintained as part of the CPython project, especially when (as some eventually will) they use internal implementation details in the test. (This will be necessary sometimes because e.g. the fuzz test should never enter Python's interpreter loop, whereas some APIs only expose themselves publicly as Python functions.) This particular set of changes is part of testing Python's builtins, tracked internally at Google by b/37562550. The _xxtestfuzz module that this change adds need not be shipped with binary distributions of Python.
* bpo-29781: Fix SSLObject.version before handshake (#3364)Christian Heimes2017-09-061-0/+2
| | | | | | SSLObject.version() now correctly returns None when handshake over BIO has not been performed yet. Signed-off-by: Christian Heimes <christian@python.org>
* Link to blurb on PyPI in the NEWS.d READMEs. (#3323)Gregory P. Smith2017-09-051-1/+3
|
generated by cgit v0.12 at 2025-04-23 21:18:39 (GMT)