gh-123067: Fix quadratic complexity in parsing cookies with backslashes #123075

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merged

serhiy-storchaka merged 4 commits into python:main from serhiy-storchaka:http-coockies-optimize-re

Aug 17, 2024

Member

serhiy-storchaka commented Aug 16, 2024 •

edited by bedevere-app bot

Loading

This fixes CVE-2024-7592.

Issue: CVE-2024-7592: Denial of Service Vulnerability in http.cookies._unquote() #123067

serhiy-storchaka added type-security needs backport to 3.8 needs backport to 3.9 needs backport to 3.10 needs backport to 3.11 needs backport to 3.12 needs backport to 3.13 labels

bedevere-app bot mentioned this pull request

CVE-2024-7592: Denial of Service Vulnerability in http.cookies._unquote() #123067

Closed

bedevere-app bot added the awaiting core review label


          pythongh-123067: Fix quadratic complexity in parsing cookies with bac…

04ac47b

…kslashes

This fixes CVE-2024-7592.

serhiy-storchaka force-pushed the http-coockies-optimize-re branch from 73e2aa9 to 04ac47b Compare

August 16, 2024 16:22

serhiy-storchaka mentioned this pull request

gh-123067: Denial of Service Vulnerability in http.cookies._unquote() #123066

Closed

serhiy-storchaka commented

View reviewed changes

Lib/test/test_http_cookies.py Outdated Show resolved Hide resolved


          Restore the current behavior for backslash-escaping.

ab87c99

picnixz reviewed

View reviewed changes

Lib/http/cookies.py Outdated Show resolved Hide resolved

Misc/NEWS.d/next/Library/2024-08-16-19-13-21.gh-issue-123067.Nx9O4R.rst Outdated Show resolved Hide resolved

sethmlarson approved these changes

View reviewed changes

Contributor

sethmlarson left a comment

Ran the new tests with and without the changes, the approach looks good to me! Thanks @serhiy-storchaka! 🙏

serhiy-storchaka added 2 commits

August 17, 2024 12:40


          Cache the sub() method, not the compiled pattern object.

1fe2492


          Add a reference to the module in NEWS.

8256ed2

picnixz approved these changes

View reviewed changes

serhiy-storchaka merged commit 44e4583 into python:main

34 checks passed

miss-islington-app bot commented Aug 17, 2024

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖

bedevere-app bot removed the awaiting core review label

serhiy-storchaka deleted the http-coockies-optimize-re branch

August 17, 2024 13:30

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

70390bb

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot commented Aug 17, 2024

GH-123103 is a backport of this pull request to the 3.13 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

6a33a68

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot removed the needs backport to 3.13 label

bedevere-app bot commented Aug 17, 2024

GH-123104 is a backport of this pull request to the 3.12 branch.

bedevere-app bot removed the needs backport to 3.12 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

dcfd909

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot commented Aug 17, 2024

GH-123105 is a backport of this pull request to the 3.11 branch.

bedevere-app bot removed the needs backport to 3.11 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

c4412d3

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot commented Aug 17, 2024

GH-123106 is a backport of this pull request to the 3.10 branch.

bedevere-app bot removed the needs backport to 3.10 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

15eec9d

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot commented Aug 17, 2024

GH-123107 is a backport of this pull request to the 3.9 branch.

bedevere-app bot removed the needs backport to 3.9 label

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

fa88d41

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

bedevere-app bot commented Aug 17, 2024

GH-123108 is a backport of this pull request to the 3.8 branch.

bedevere-app bot removed the needs backport to 3.8 label

jeremyhylton pushed a commit to jeremyhylton/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

rickprice added a commit to ActiveState/cpython that referenced this pull request


          CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie

6755e54

pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

rickprice added a commit to ActiveState/cpython that referenced this pull request


          CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie

ed12fce

pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

Redo tests without a subtest

Backport how RegEx stuff is handled to Python2

rickprice added a commit to ActiveState/cpython that referenced this pull request


          CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie

096104d

pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

rickprice mentioned this pull request

CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie ActiveState/cpython#62

Merged

blhsing pushed a commit to blhsing/cpython that referenced this pull request


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

f619de1

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

Akendo added a commit to gardenlinux/package-python3.12 that referenced this pull request


          Include upstream patch for python for CVE-2024-7592

031f522

We create a patch from the PR on GitHub that address the vulerability.

python/cpython#123075

Akendo mentioned this pull request

Include upstream patch for python for CVE-2024-7592 gardenlinux/package-python3.12#1

Closed

hauntsaninja pushed a commit that referenced this pull request


          [3.13] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

391e562

… values with backslashes (GH-123075) (#123103)

gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

hauntsaninja pushed a commit that referenced this pull request


          [3.12] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

dcc3eae

… values with backslashes (GH-123075) (#123104)

gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ambv pushed a commit that referenced this pull request


          [3.8] gh-123067: Fix quadratic complexity in parsing "-quoted cookie …

a77ab24

…values with backslashes (GH-123075) (#123108)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ambv pushed a commit that referenced this pull request


          [3.9] gh-123067: Fix quadratic complexity in parsing "-quoted cookie …

d662e2d

…values with backslashes (GH-123075) (#123107)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ambv pushed a commit that referenced this pull request


          [3.11] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

d4ac921

… values with backslashes (GH-123075) (#123105)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

ambv pushed a commit that referenced this pull request


          [3.10] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

b2f11ca

… values with backslashes (GH-123075) (#123106)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>

vEpiphyte mentioned this pull request

Add http.coookies monkeypatch (SYN-8465) vertexproject/synapse#4045

Merged

vEpiphyte added a commit to vertexproject/synapse that referenced this pull request


          Add http.coookies monkeypatch (SYN-8465) (#4045)

746605b

Vendor the fixes from CPython for
GHSA-7pwv-g7hj-39pr and applies them at
import time of `synapse.common`.

python/cpython#123067
python/cpython#123075

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment