Benjamin Peterson
e052d40cea
[2.7] bpo-32981: Fix catastrophic backtracking vulns (GH-5955)
...
* Prevent low-grade poplib REDOS (CVE-2018-1060)
The regex to test a mail server's timestamp is susceptible to
catastrophic backtracking on long evil responses from the server.
Happily, the maximum length of malicious inputs is 2K thanks
to a limit introduced in the fix for CVE-2013-1752.
A 2KB evil response from the mail server would result in small slowdowns
(milliseconds vs. microseconds) accumulated over many apop calls.
This is a potential DOS vector via accumulated slowdowns.
Replace it with a similar non-vulnerable regex.
The new regex is RFC compliant.
The old regex was non-compliant in edge cases.
* Prevent difflib REDOS (CVE-2018-1061)
The default regex for IS_LINE_JUNK is susceptible to
catastrophic backtracking.
This is a potential DOS vector.
Replace it with an equivalent non-vulnerable regex.
Also introduce unit and REDOS tests for difflib.
Co-authored-by: Tim Peters <tim.peters@gmail.com >
Co-authored-by: Christian Heimes <christian@python.org >.
(cherry picked from commit 0e6c8ee235 )
2018-03-03 22:18:17 -08:00
..
2013-10-13 17:47:22 +03:00
2016-01-15 00:25:29 +00:00
2011-05-30 23:58:21 +02:00
2014-01-16 18:59:17 +02:00
2014-12-07 14:19:15 -05:00
2016-07-28 03:04:04 +00:00
2014-01-26 23:48:20 +02:00
2013-08-13 12:53:40 +03:00
2015-04-06 23:39:47 +02:00
2018-02-23 08:27:28 -08:00
2017-09-25 01:43:56 -07:00
2017-05-02 18:26:25 +03:00
2016-07-11 07:51:37 +00:00
2016-09-06 23:25:35 +02:00
2014-12-15 14:02:43 +02:00
2013-12-28 10:33:58 -06:00
2017-11-23 17:04:34 +01:00
2014-01-16 18:59:17 +02:00
2015-04-02 00:04:06 -04:00
2017-09-13 03:26:54 -07:00
2013-09-05 17:28:10 +03:00
2014-11-23 11:42:45 -06:00
2014-08-20 14:14:50 -05:00
2014-08-20 14:14:50 -05:00
2014-08-20 14:14:50 -05:00
2013-08-23 13:26:49 -04:00
2018-02-02 16:29:02 +02:00
2017-06-23 14:13:39 +03:00
2016-09-06 23:25:35 +02:00
2018-02-02 16:29:02 +02:00
2012-08-14 11:41:19 +01:00
2017-07-03 22:01:57 +02:00
2011-10-01 19:30:58 +02:00
2013-08-23 13:26:49 -04:00
2017-05-02 21:56:52 +03:00
2014-08-20 14:14:50 -05:00
2011-03-16 12:34:31 +02:00
2014-06-07 16:44:00 -07:00
2018-01-17 17:58:16 +01:00
2014-09-14 17:40:44 +03:00
2017-11-23 18:34:59 +01:00
2014-08-20 14:14:50 -05:00
2012-09-10 11:20:47 -04:00
2012-09-10 11:20:47 -04:00
2017-04-30 11:36:58 +03:00
2016-01-15 00:25:29 +00:00
2016-03-30 20:43:06 +03:00
2014-08-20 14:14:50 -05:00
2014-08-20 14:14:50 -05:00
2014-08-20 14:14:50 -05:00
2014-08-20 14:14:50 -05:00
2016-09-22 16:53:15 +02:00
2016-04-10 09:39:07 +00:00
2012-03-08 18:28:08 -05:00
2014-11-02 19:08:35 +02:00
2014-01-16 18:59:17 +02:00
2015-12-12 06:53:34 +00:00
2014-06-25 13:33:57 -07:00
2017-10-17 02:25:23 -07:00
2013-12-10 14:09:20 -06:00
2018-02-21 08:37:18 +02:00
2014-01-16 18:59:17 +02:00
2014-01-16 18:59:17 +02:00
2016-04-05 06:19:42 +00:00
2016-09-07 11:04:41 +00:00
2013-08-17 16:56:09 +03:00
2014-07-24 19:15:00 +02:00
2017-07-27 01:24:52 +02:00
2017-06-12 09:10:53 +03:00
2017-08-26 21:56:31 +03:00
2016-02-23 22:30:50 +00:00
2011-01-14 20:19:57 +00:00
2015-03-30 09:27:20 +03:00
2016-09-14 16:36:15 +03:00
2014-01-16 18:59:17 +02:00
2016-04-17 09:37:36 +03:00
2017-07-05 09:16:47 +02:00
2014-12-15 14:02:43 +02:00
2017-07-26 17:55:52 +02:00
2017-07-05 14:09:36 +02:00
2017-08-02 11:33:33 +03:00
2015-08-02 15:19:04 +03:00
2017-11-23 18:23:37 +01:00
2017-10-29 12:25:38 +02:00
2015-04-01 12:56:39 +03:00
2016-09-27 22:45:20 -04:00
2016-05-20 22:31:24 +03:00
2014-01-16 18:59:17 +02:00
2014-12-15 14:02:43 +02:00
2015-02-16 01:49:22 +02:00
2014-01-16 18:59:17 +02:00
2017-05-20 10:04:53 +03:00
2015-06-23 14:31:11 +02:00
2015-12-03 01:23:10 +00:00
2012-11-23 18:46:11 +02:00
2016-04-17 09:37:36 +03:00
2016-10-04 18:17:08 +03:00
2015-05-18 16:08:38 +03:00
2017-07-03 22:01:57 +02:00
2017-07-03 22:01:57 +02:00
2017-07-03 22:01:57 +02:00
2017-07-03 22:01:57 +02:00
2017-07-03 22:01:57 +02:00
2017-07-03 22:01:57 +02:00
2017-07-03 22:01:57 +02:00
2017-07-03 22:01:57 +02:00
2017-07-03 22:01:57 +02:00
2017-07-03 22:01:57 +02:00
2017-07-03 22:01:57 +02:00
2017-11-29 02:15:43 +02:00
2012-12-18 21:27:37 +02:00
2015-11-25 17:19:27 +02:00
2011-04-05 17:16:09 -07:00
2016-01-22 12:33:12 +01:00
2013-11-03 23:15:46 +02:00
2017-04-30 11:36:58 +03:00
2017-02-20 21:14:52 +00:00
2015-06-28 17:11:51 +03:00
2015-05-23 10:46:25 -05:00
2016-07-28 01:11:04 +00:00
2017-08-05 18:03:01 +03:00
2016-03-06 15:03:16 +02:00
2015-11-29 13:12:40 +02:00
2017-10-24 23:35:22 +03:00
2018-02-10 00:02:04 +02:00
2017-11-03 22:11:12 +02:00
2017-10-23 19:57:04 +03:00
2011-03-14 16:03:54 -04:00
2015-06-24 13:36:53 -07:00
2011-12-08 00:00:49 +02:00
2016-07-28 01:11:04 +00:00
2017-08-02 11:33:33 +03:00
2013-03-11 17:56:17 -04:00
2018-02-02 16:29:02 +02:00
2013-01-16 13:52:22 -08:00
2018-02-27 00:35:03 +02:00
2018-03-03 22:18:17 -08:00
2016-04-12 08:47:20 +03:00
2014-01-16 18:59:17 +02:00
2016-07-28 03:04:04 +00:00
2016-08-18 06:12:22 +00:00
2016-12-02 07:58:42 +02:00
2016-03-14 10:28:59 +02:00
2013-02-09 12:53:29 -05:00
2017-09-25 11:03:24 +10:00
2013-11-03 23:15:46 +02:00
2014-01-16 18:59:17 +02:00
2014-03-25 12:53:47 +01:00
2014-01-16 18:59:17 +02:00
2016-02-28 00:18:43 +00:00
2016-10-02 11:10:18 +03:00
2014-02-07 10:06:05 +02:00
2018-01-02 09:25:41 -08:00
2012-10-12 13:02:06 -07:00
2015-08-02 15:19:04 +03:00
2016-03-08 18:35:45 +02:00
2016-11-14 03:35:59 +00:00
2015-11-29 20:13:56 +02:00
2017-05-21 10:37:43 +03:00
2016-12-01 10:27:11 +02:00
2012-02-29 14:04:02 +02:00
2018-02-25 00:45:53 +01:00
2017-11-08 14:45:55 -08:00
2017-10-17 02:25:23 -07:00
2017-02-10 14:14:04 +01:00
2012-02-20 21:47:54 -05:00
2017-12-02 21:00:09 +02:00
2015-02-13 12:02:05 +02:00
2013-01-31 16:10:15 +02:00
2016-07-01 23:34:44 +03:00
2016-11-14 19:25:44 +02:00
2014-01-16 18:59:17 +02:00
2018-01-17 15:15:46 -08:00
2018-01-04 10:36:14 +02:00
2013-12-10 14:09:20 -06:00
2017-10-22 14:54:05 +03:00
2014-09-05 21:05:05 +02:00
2016-05-26 05:28:50 +00:00
2013-09-14 22:17:39 -07:00
2014-09-05 21:05:05 +02:00
2015-06-27 14:52:41 -05:00
2014-02-01 21:20:22 +02:00
2018-02-25 00:45:53 +01:00
2016-09-10 10:38:22 +00:00
2014-06-02 16:01:16 -05:00
2016-05-08 13:45:55 +00:00
2014-06-02 16:01:16 -05:00
2014-01-16 18:59:17 +02:00
2014-01-26 23:48:20 +02:00
2013-12-10 14:09:20 -06:00
2017-06-13 20:58:48 +10:00
2017-06-04 17:45:02 -05:00
2013-12-10 14:09:20 -06:00
2017-05-09 11:53:16 +02:00
2015-11-29 20:13:56 +02:00
2017-11-06 16:17:54 -08:00
2016-03-30 21:02:00 +03:00
2011-03-16 12:34:31 +02:00
2017-11-08 14:45:55 -08:00
2017-11-09 19:04:47 +02:00
2017-04-30 11:36:58 +03:00
2014-08-06 18:31:54 +03:00
2015-11-29 16:33:18 +01:00
2014-01-16 18:59:17 +02:00
2016-08-29 19:38:12 +01:00
2013-12-10 14:09:20 -06:00
2013-12-10 14:09:20 -06:00
2015-02-13 12:02:05 +02:00
2013-10-23 21:45:58 -07:00
2017-09-30 22:52:25 +03:00
2016-07-06 23:37:02 -07:00
2013-11-03 23:15:46 +02:00
2017-05-02 18:26:25 +03:00
2017-08-02 11:33:33 +03:00
2014-06-29 13:02:12 -07:00
2015-11-26 23:48:30 +02:00
2016-10-05 22:09:31 -07:00
2012-02-20 15:20:37 -05:00
2016-05-09 00:02:06 +03:00
2011-03-27 21:01:03 +02:00
2015-02-21 01:19:17 +02:00
2018-01-29 16:54:29 +01:00
2016-04-17 09:37:36 +03:00
2012-12-28 00:32:19 +02:00
2017-12-10 15:09:58 +09:00
2013-12-10 14:09:20 -06:00
2014-01-22 13:18:09 +01:00
2014-11-06 14:37:49 +01:00
2015-03-25 16:39:58 +02:00
2012-10-23 14:42:13 +03:00
2013-06-10 16:27:45 +01:00
2016-04-23 10:53:28 +03:00
2014-04-15 16:44:43 -04:00
2018-02-27 00:35:03 +02:00
2018-01-15 23:39:04 +02:00
2017-04-20 00:48:57 +03:00
2015-09-05 19:13:17 -04:00
2012-11-05 00:03:21 +02:00
2016-09-07 12:03:06 +00:00
2015-09-06 14:16:18 +03:00
2015-11-29 13:12:40 +02:00
2011-02-24 20:34:38 +00:00
2011-03-16 12:34:31 +02:00
2014-02-16 14:51:17 -05:00
2016-06-08 06:12:22 +00:00
2013-04-23 13:47:06 +02:00
2017-10-18 15:04:04 +03:00
2014-01-16 18:59:17 +02:00
2014-01-16 18:59:17 +02:00
2018-03-03 22:18:17 -08:00
2017-07-27 18:44:43 +02:00
2016-08-24 08:59:47 -04:00
2015-05-16 21:34:56 +03:00
2016-04-15 02:14:19 +00:00
2013-01-28 13:24:01 +02:00
2017-10-02 02:58:09 -07:00
2013-12-10 14:09:20 -06:00
2016-09-07 12:03:06 +00:00
2015-09-06 14:16:18 +03:00
2014-11-07 22:31:54 +02:00
2017-07-27 18:05:44 +02:00
2016-07-14 01:31:46 +00:00
2013-03-23 23:35:06 +02:00
2017-10-22 12:15:41 +03:00
2017-12-12 20:49:18 +02:00
2016-08-27 02:54:43 +00:00
2017-10-17 02:25:23 -07:00
2013-12-10 14:14:28 -06:00
2013-12-10 14:09:20 -06:00
2015-01-25 23:34:42 -05:00
2015-11-23 23:50:26 +00:00
2017-07-05 10:00:33 +02:00
2015-12-03 01:23:10 +00:00
2017-05-05 10:11:55 +02:00
2012-11-01 20:13:54 +01:00
2016-09-08 15:25:19 -07:00
2014-12-15 14:02:43 +02:00
2016-08-09 14:57:03 +01:00
2016-12-16 19:04:17 +02:00
2017-08-22 16:51:09 +02:00
2017-05-04 18:52:26 +02:00
2016-04-16 14:47:12 -07:00
2016-12-01 23:58:38 -08:00
2014-01-16 18:59:17 +02:00
2017-12-13 23:23:40 +01:00
2017-09-27 03:02:57 -07:00
2016-03-20 22:29:40 +02:00
2014-05-25 16:21:32 +03:00
2018-02-25 09:48:02 +01:00
2017-05-11 01:23:19 +02:00
2013-06-23 16:27:01 +02:00
2017-03-01 14:28:14 +08:00
2017-11-29 16:29:54 +01:00
2016-06-03 09:37:39 +03:00
2013-03-19 17:17:47 -07:00
2015-01-18 11:42:50 +02:00
2018-02-06 09:29:21 -08:00
2016-03-12 10:51:16 +02:00
2013-11-26 20:00:34 +01:00
2015-02-21 19:51:17 +02:00
2014-02-07 10:06:05 +02:00
2016-07-28 01:11:04 +00:00
2018-01-25 22:41:38 +01:00
2013-12-14 20:34:33 +02:00
2015-01-26 11:54:32 +02:00
2017-04-30 11:36:58 +03:00
2012-02-20 20:42:21 -05:00
2018-01-04 10:36:14 +02:00
2016-06-02 10:35:44 +00:00
2018-01-04 10:36:14 +02:00
2017-10-17 02:25:23 -07:00
2015-02-16 01:49:22 +02:00
2016-10-30 20:52:55 +02:00
2017-10-04 21:37:53 +03:00
2016-05-26 05:28:50 +00:00
2017-08-10 16:45:38 +02:00
2018-02-23 08:27:28 -08:00
2015-10-28 21:39:36 +02:00
2017-08-09 16:54:53 +02:00
2015-04-01 12:56:39 +03:00
2016-03-14 10:28:59 +02:00
2016-07-28 03:04:04 +00:00
2011-03-13 19:14:21 +01:00
2017-09-06 01:35:39 +02:00
2015-05-30 19:37:19 +03:00
2013-12-10 14:09:20 -06:00
2014-06-02 16:01:16 -05:00
2015-10-06 18:13:38 +03:00
2016-09-11 09:48:57 +00:00
2016-11-11 12:11:55 +02:00
2015-09-20 08:38:40 +03:00
2014-08-24 09:07:09 +03:00
2011-02-03 00:12:18 +00:00
2016-06-05 10:35:34 +03:00
2014-02-07 10:06:05 +02:00
2015-09-06 14:16:18 +03:00
2016-12-18 05:27:49 +00:00
2018-02-25 00:45:53 +01:00
2016-05-16 01:07:13 +00:00
2017-07-19 07:07:49 +03:00
2017-06-20 16:20:36 +02:00
2016-05-07 16:41:39 +03:00
2016-04-16 07:15:38 -07:00
2015-11-02 15:06:09 +02:00
2014-10-12 22:00:10 -04:00
2014-11-07 14:07:43 +02:00
2017-11-29 10:34:40 -05:00
2013-07-04 21:03:10 +02:00
2017-09-30 17:06:55 +03:00
2013-12-14 20:34:33 +02:00
2017-10-17 02:25:23 -07:00
2014-11-24 23:57:00 +02:00
2014-01-16 18:59:17 +02:00
2016-09-07 12:03:06 +00:00
2016-09-05 18:06:06 -05:00
2014-01-16 18:59:17 +02:00
2015-09-03 02:39:57 -07:00
2014-10-10 21:11:34 +03:00
2017-10-11 16:29:12 +03:00
2017-09-25 01:43:56 -07:00
2016-05-04 11:28:09 +03:00
2015-11-07 20:04:46 +02:00
2012-09-28 20:36:36 +01:00
2016-02-25 12:55:19 +02:00
2016-10-23 22:32:18 +03:00
2012-10-15 22:29:02 -04:00
2014-02-16 14:48:26 -05:00
2016-07-23 04:22:09 +00:00
2012-04-24 22:42:08 +02:00