Skip to main content

Browse the archive

Staging
v0.8.1
https://github.com/python/cpython
09 December 2020, 11:06:31 UTC
Revision 69cdeeb93e0830004a495ed854022425b93b3f3e authored by Victor Stinner on 03 April 2020, 01:15:56 UTC, committed by GitHub on 03 April 2020, 01:15:56 UTC 
bpo-39503: CVE-2020-8492: Fix AbstractBasicAuthHandler (GH-18284) (GH-19304)
 
The AbstractBasicAuthHandler class of the urllib.request module uses
an inefficient regular expression which can be exploited by an
attacker to cause a denial of service. Fix the regex to prevent the
catastrophic backtracking. Vulnerability reported by Ben Caller
and Matt Schwager.

AbstractBasicAuthHandler of urllib.request now parses all
WWW-Authenticate HTTP headers and accepts multiple challenges per
header: use the realm of the first Basic challenge.

Co-Authored-By: Serhiy Storchaka <storchaka@gmail.com>
(cherry picked from commit 0b297d4ff1c0e4480ad33acae793fbaf4bf015b4)
1 parent ebeabb5
History
Tip revision: 69cdeeb93e0830004a495ed854022425b93b3f3e authored by Victor Stinner on 03 April 2020, 01:15:56 UTC
bpo-39503: CVE-2020-8492: Fix AbstractBasicAuthHandler (GH-18284) (GH-19304)
Tip revision: 69cdeeb
File Mode Size
ci.yml -rw-r--r-- 2.7 KB
docker-steps.yml -rw-r--r-- 2.2 KB
docs-steps.yml -rw-r--r-- 1.3 KB
macos-steps.yml -rw-r--r-- 724 bytes
posix-deps.sh -rwxr-xr-x 590 bytes
posix-steps.yml -rw-r--r-- 1.9 KB
pr.yml -rw-r--r-- 1.8 KB
prebuild-checks.yml -rw-r--r-- 1.2 KB
windows-steps.yml -rw-r--r-- 1.1 KB
back to top