Most recent entries from all

CVE-2021-21240 — Regular Expression Denial of Service in httplib2

Affected: httplib2

httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of "\xa0" characters in the "www-authenticate" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library.

GHSA-93xj-8mrv-444m — Regular Expression Denial of Service (REDoS) in httplib2

Affected: PyPI: httplib2

### Impact A malicious server which responds with long series of `\xa0` characters in the `www-authenticate` header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.

### Patches Version 0.19.0 contains new implementation of auth headers parsing, using pyparsing library. https://github.com/httplib2/httplib2/pull/182

### Workarounds ```py import httplib2 httplib2.USE_WWW_AUTH_STRICT_PARSING = True ```

### Technical Details

The vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/__init__.py#L336-L338

The section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:

\s*[^ \t\r\n=]+\s*=

Since all three infinitely repeating groups accept the non-breaking space character `\xa0`, a long string of `\xa0` causes catastrophic backtracking.

The complexity is cubic, so doubling the length of the malicious string of `\xa0` makes processing take 8 times as long.

### Reproduction Steps

Run a malicious server which responds with

www-authenticate: x \xa0\xa0\xa0\xa0x

but with many more `\xa0` characters.

An example malicious python server is below:

```py from http.server import BaseHTTPRequestHandler, HTTPServer

def make_header_value(n_spaces): repeat = "\xa0" * n_spaces return f"x {repeat}x"

class Handler(BaseHTTPRequestHandler): def do_GET(self): self…

PYSEC-2021-16

Affected: PyPI: httplib2