Skip to main content

Browse the archive

Staging
v0.5.1
https://github.com/python/cpython
09 December 2020, 11:06:31 UTC
Revision 942cc04ae44825ea120e3a19a80c9b348b8194d0 authored by Ned Deily on 11 March 2018, 18:28:53 UTC, committed by larryhastings on 11 March 2018, 18:28:53 UTC 
[3.4] bpo-32981: Fix catastrophic backtracking vulns (GH-5955) (#6035)
 
* Prevent low-grade poplib REDOS (CVE-2018-1060)

The regex to test a mail server's timestamp is susceptible to
catastrophic backtracking on long evil responses from the server.

Happily, the maximum length of malicious inputs is 2K thanks
to a limit introduced in the fix for CVE-2013-1752.

A 2KB evil response from the mail server would result in small slowdowns
(milliseconds vs. microseconds) accumulated over many apop calls.
This is a potential DOS vector via accumulated slowdowns.

Replace it with a similar non-vulnerable regex.

The new regex is RFC compliant.
The old regex was non-compliant in edge cases.

* Prevent difflib REDOS (CVE-2018-1061)

The default regex for IS_LINE_JUNK is susceptible to
catastrophic backtracking.
This is a potential DOS vector.

Replace it with an equivalent non-vulnerable regex.

Also introduce unit and REDOS tests for difflib.

Co-authored-by: Tim Peters <tim.peters@gmail.com>
Co-authored-by: Christian Heimes <christian@python.org>.
1 parent f584ecd
Raw File
Tip revision: 942cc04ae44825ea120e3a19a80c9b348b8194d0 authored by Ned Deily on 11 March 2018, 18:28:53 UTC
[3.4] bpo-32981: Fix catastrophic backtracking vulns (GH-5955) (#6035)
Tip revision: 942cc04
.travis.yml 
language: c
dist: trusty
sudo: false
group: beta

# To cache doc-building dependencies.
cache: pip

branches:
  only:
    - master
    - /^\d\.\d$/

matrix:
  fast_finish: true
  allow_failures:
    - env: OPTIONAL=true
  include:
    - os: linux
      language: c
      compiler: clang
      # gcc also works, but to keep the # of concurrent builds down, we use one C
      # compiler here and the other to run the coverage build. Clang is preferred
      # in this instance for its better error messages.
      env: TESTING=cpython
    - os: osx
      language: c
      compiler: clang
      # Testing under macOS is optional until testing stability has been demonstrated.
      env: OPTIONAL=true
      before_install:
        - brew install openssl xz
        - export CPPFLAGS="-I$(brew --prefix openssl)/include"
        - export LDFLAGS="-L$(brew --prefix openssl)/lib"

# Travis provides only 2 cores, so don't overdo the parallelism and waste memory.
before_script:
  - |
      set -e
      if ! git diff --name-only $TRAVIS_COMMIT_RANGE | grep -qvE '(\.rst$)|(^Doc)|(^Misc)'
      then
        echo "Only docs were updated, stopping build process."
        exit
      fi
      ./configure --with-pydebug
      make -j4

script:
  # Using the built Python as patchcheck.py is built around the idea of using
  # a checkout-build of CPython to know things like what base branch the changes
  # should be compared against.
  # Only run on Linux as the check only needs to be run once.
  - if [[ "$TRAVIS_OS_NAME" == "linux" ]]; then ./python Tools/scripts/patchcheck.py --travis $TRAVIS_PULL_REQUEST; fi
  # `-r -w` implicitly provided through `make buildbottest`.
  - make buildbottest TESTOPTS="-j4 -uall,-cpu"

notifications:
  email: false
  irc:
    channels:
      # This is set to a secure variable to prevent forks from notifying the
      # IRC channel whenever they fail a build. This can be removed when travis
      # implements https://github.com/travis-ci/travis-ci/issues/1094.
      # The actual value here is: irc.freenode.net#python-dev
      - secure: "s7kAkpcom2yUJ8XqyjFI0obJmhAGrn1xmoivdaPdgBIA++X47TBp1x4pgDsbEsoalef7bEwa4l07KdT4qa+DOd/c4QxaWom7fbN3BuLVsZuVfODnl79+gYq/TAbGfyH+yDs18DXrUfPgwD7C5aW32ugsqAOd4iWzfGJQ5OrOZzqzGjYdYQUEkJFXgxDEIb4aHvxNDWGO3Po9uKISrhb5saQ0l776yLo1Ur7M4oxl8RTbCdgX0vf5TzPg52BgvZpOgt3DHOUYPeiJLKNjAE6ibg0U95sEvMfHX77nz4aFY4/3UI6FFaRla34rZ+mYKrn0TdxOhera1QOgPmM6HzdO4K44FpfK1DS0Xxk9U9/uApq+cG0bU3W+cVUHDBe5+90lpRBAXHeHCgT7TI8gec614aiT8lEr3+yH8OBRYGzkjNK8E2LJZ/SxnVxDe7aLF6AWcoWLfS6/ziAIBFQ5Nc4U72CT8fGVSkl8ywPiRlvixKdvTODMSZo0jMqlfZSNaAPTsNRx4wu5Uis4qekwe32Fz4aB6KGpsuuVjBi+H6v0RKxNJNGY3JKDiEH2TK0UE2auJ5GvLW48aUVFcQMB7euCWYXlSWVRHh3WLU8QXF29Dw4JduRZqUpOdRgMHU79UHRq+mkE0jAS/nBcS6CvsmxCpTSrfVYuMOu32yt18QQoTyU="
    on_success: change
    on_failure: always
    skip_join: true
back to top