bpo-37461: Fix infinite loop in parsing of specially crafted email headers #14794

maxking · 2019-07-16T15:08:57Z

Some crafted email header would cause the get_parameter method to run in an
infinite loop causing a DoS attack surface when parsing those headers. This
patch fixes that by making sure the DQUOTE character is handled to prevent
going into an infinite loop.

https://bugs.python.org/issue37461

…aders. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop.

maxking · 2019-07-16T15:10:04Z

working on adding tests and NEWS entry.

maxking · 2019-07-16T15:20:24Z

I have added a slightly different test case than given in BPO and that fails with a different exception. I'll keep this PR around and convert it to a WIP, while I figure out what is going on. I may need to dig deeper than I originally thought and might need more time :)

mangrisano · 2019-07-16T17:12:08Z

/cc @bitdancer

aeros · 2019-07-17T07:38:42Z

@maxking Instead of using WIP, you can also start the PR as a draft and open it once the tests are passing. I don't think it's possible to do this for a PR that's already been opened, but just for any future PRs it's a useful feature that I've started using recently.

maxking · 2019-07-17T12:12:54Z

@aeros167 Yeah, I added the tests after I opened the PR, which is why I had to switch it to WIP.

It is a feature in Gitlab, which I more frequently use, where you can switch between WIP PRs (a.k.a draft PR) and normal ones by just adding the WIP: prefix.

Thanks for the tip though, I should have opened a draft PR initially.

maxking · 2019-07-17T13:37:16Z

So, I think my initial solution was correct, but my test case was wrong. That is a separate bug and I am working on a separate PR to fix that. Pushed a fix and I think this is ready for a review now.

Fingers crossed for the tests (they passed locally) ;-)

miss-islington · 2019-07-17T16:44:31Z

Thanks @maxking for the PR, and @warsaw for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

miss-islington · 2019-07-17T16:44:32Z

I'm having trouble backporting to 3.8. Reason: 'Error 110 while writing to socket. Connection timed out.'. Please retry by removing and re-adding the needs backport to 3.8 label.

…aders (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>

bedevere-bot · 2019-07-17T16:44:49Z

GH-14816 is a backport of this pull request to the 3.7 branch.

…aders (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>

bedevere-bot · 2019-07-17T16:44:56Z

GH-14817 is a backport of this pull request to the 3.6 branch.

miss-islington · 2019-07-17T16:45:04Z

Thanks @maxking for the PR, and @warsaw for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6.
🐍🍒⛏🤖

miss-islington · 2019-07-17T16:45:20Z

Thanks @maxking for the PR, and @warsaw for merging it 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

miss-islington · 2019-07-17T16:45:20Z

Thanks @maxking for the PR, and @warsaw for merging it 🌮🎉.. I'm working now to backport this PR to: 3.8.
🐍🍒⛏🤖

…aders (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>

bedevere-bot · 2019-07-17T16:45:29Z

GH-14818 is a backport of this pull request to the 3.8 branch.

…aders (GH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>

…aders (GH-14794) (GH-14817) Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>

…ail headers (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>

…ail headers (GH-14794) (#15446) * [3.5] bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794) Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop. (cherry picked from commit a4a994b) Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com> Co-Authored-By: Ashwin Ramaswami <aramaswamis@gmail.com>

…aders (pythonGH-14794) * bpo-37461: Fix infinite loop in parsing of specially crafted email headers. Some crafted email header would cause the get_parameter method to run in an infinite loop causing a DoS attack surface when parsing those headers. This patch fixes that by making sure the DQUOTE character is handled to prevent going into an infinite loop.

maxking requested a review from a team as a code owner July 16, 2019 15:08

the-knights-who-say-ni added the CLA signed label Jul 16, 2019

bedevere-bot added the awaiting review label Jul 16, 2019

Add test and NEWS entry.

23a1fbc

maxking changed the title ~~bpo-37461: Fix infinite loop in parsing of specially crafted email headers~~ WIP: bpo-37461: Fix infinite loop in parsing of specially crafted email headers Jul 16, 2019

Fix the test to invoke the right infinite loop.

cc4ed70

maxking changed the title ~~WIP: bpo-37461: Fix infinite loop in parsing of specially crafted email headers~~ bpo-37461: Fix infinite loop in parsing of specially crafted email headers Jul 17, 2019

warsaw added needs backport to 3.6 type-security A security issue labels Jul 17, 2019

warsaw approved these changes Jul 17, 2019

View reviewed changes

bedevere-bot added awaiting merge and removed awaiting review labels Jul 17, 2019

warsaw merged commit a4a994b into python:master Jul 17, 2019

bedevere-bot removed the awaiting merge label Jul 17, 2019

bedevere-bot removed the needs backport to 3.7 label Jul 17, 2019

bedevere-bot removed the needs backport to 3.6 label Jul 17, 2019

warsaw added the needs backport to 3.6 label Jul 17, 2019

warsaw added needs backport to 3.7 and removed needs backport to 3.8 labels Jul 17, 2019

bedevere-bot removed the needs backport to 3.8 label Jul 17, 2019

maxking mentioned this pull request Aug 24, 2019

[3.5] bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794) #15446

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

bpo-37461: Fix infinite loop in parsing of specially crafted email headers #14794

bpo-37461: Fix infinite loop in parsing of specially crafted email headers #14794

Uh oh!

maxking commented Jul 16, 2019 •

edited by bedevere-bot

Loading

Uh oh!

maxking commented Jul 16, 2019

Uh oh!

maxking commented Jul 16, 2019

Uh oh!

mangrisano commented Jul 16, 2019

Uh oh!

aeros commented Jul 17, 2019

Uh oh!

maxking commented Jul 17, 2019

Uh oh!

maxking commented Jul 17, 2019 •

edited

Loading

Uh oh!

miss-islington commented Jul 17, 2019

Uh oh!

miss-islington commented Jul 17, 2019

Uh oh!

bedevere-bot commented Jul 17, 2019

Uh oh!

bedevere-bot commented Jul 17, 2019

Uh oh!

miss-islington commented Jul 17, 2019

Uh oh!

miss-islington commented Jul 17, 2019

Uh oh!

miss-islington commented Jul 17, 2019

Uh oh!

bedevere-bot commented Jul 17, 2019

Uh oh!

Uh oh!

Uh oh!

bpo-37461: Fix infinite loop in parsing of specially crafted email headers #14794

bpo-37461: Fix infinite loop in parsing of specially crafted email headers #14794

Uh oh!

Conversation

maxking commented Jul 16, 2019 • edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

maxking commented Jul 16, 2019

Uh oh!

maxking commented Jul 16, 2019

Uh oh!

mangrisano commented Jul 16, 2019

Uh oh!

aeros commented Jul 17, 2019

Uh oh!

maxking commented Jul 17, 2019

Uh oh!

maxking commented Jul 17, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

miss-islington commented Jul 17, 2019

Uh oh!

miss-islington commented Jul 17, 2019

Uh oh!

bedevere-bot commented Jul 17, 2019

Uh oh!

bedevere-bot commented Jul 17, 2019

Uh oh!

miss-islington commented Jul 17, 2019

Uh oh!

miss-islington commented Jul 17, 2019

Uh oh!

miss-islington commented Jul 17, 2019

Uh oh!

bedevere-bot commented Jul 17, 2019

Uh oh!

Uh oh!

maxking commented Jul 16, 2019 •

edited by bedevere-bot

Loading

maxking commented Jul 17, 2019 •

edited

Loading