Staging
v0.5.1
https://github.com/python/cpython
Revision 69cdeeb93e0830004a495ed854022425b93b3f3e authored by Victor Stinner on 03 April 2020, 01:15:56 UTC, committed by GitHub on 03 April 2020, 01:15:56 UTC
The AbstractBasicAuthHandler class of the urllib.request module uses
an inefficient regular expression which can be exploited by an
attacker to cause a denial of service. Fix the regex to prevent the
catastrophic backtracking. Vulnerability reported by Ben Caller
and Matt Schwager.

AbstractBasicAuthHandler of urllib.request now parses all
WWW-Authenticate HTTP headers and accepts multiple challenges per
header: use the realm of the first Basic challenge.

Co-Authored-By: Serhiy Storchaka <storchaka@gmail.com>
(cherry picked from commit 0b297d4ff1c0e4480ad33acae793fbaf4bf015b4)
1 parent ebeabb5
Raw File
Tip revision: 69cdeeb93e0830004a495ed854022425b93b3f3e authored by Victor Stinner on 03 April 2020, 01:15:56 UTC
bpo-39503: CVE-2020-8492: Fix AbstractBasicAuthHandler (GH-18284) (GH-19304)
Tip revision: 69cdeeb
.gitattributes
# Binary data types
*.aif binary
*.aifc binary
*.aiff binary
*.au binary
*.bmp binary
*.exe binary
*.icns binary
*.gif binary
*.ico binary
*.jpg binary
*.pck binary
*.png binary
*.psd binary
*.tar binary
*.wav binary
*.whl binary
*.zip binary

# Specific binary files
Lib/test/sndhdrdata/sndhdr.* binary

# Text files that should not be subject to eol conversion
Lib/test/cjkencodings/* -text
Lib/test/decimaltestdata/*.decTest -text
Lib/test/test_email/data/*.txt -text
Lib/test/xmltestdata/* -text
Lib/test/coding20731.py -text

# Special files in third party code
Modules/zlib/zlib.map -text

# CRLF files
*.bat text eol=crlf
*.ps1 text eol=crlf
*.sln text eol=crlf
*.vcxproj* text eol=crlf
*.props text eol=crlf
*.proj text eol=crlf
PCbuild/readme.txt text eol=crlf
PC/readme.txt text eol=crlf

# Generated files
# https://github.com/github/linguist#generated-code
Include/graminit.h          linguist-generated=true
Python/graminit.h           linguist-generated=true
Modules/clinic/*.h          linguist-generated=true
Objects/clinic/*.h          linguist-generated=true
PC/clinic/*.h               linguist-generated=true
Python/clinic/*.h           linguist-generated=true
Python/importlib.h          linguist-generated=true
Python/importlib_external.h linguist-generated=true
Include/Python-ast.h        linguist-generated=true
Python/Python-ast.c         linguist-generated=true
Include/opcode.h            linguist-generated=true
Python/opcode_targets.h     linguist-generated=true
Objects/typeslots.inc       linguist-generated=true
Modules/unicodedata_db.h    linguist-generated=true
back to top