Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJ2OTUtNHd4ai02ZnFx

Loop with Unreachable Exit Condition ('Infinite Loop') in Pylons Colander

In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.

Permalink: https://github.com/advisories/GHSA-rv95-4wxj-6fqq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJ2OTUtNHd4ai02ZnFx
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 4 years ago
Updated: about 1 month ago

CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-rv95-4wxj-6fqq, CVE-2017-18361
References:

• https://nvd.nist.gov/vuln/detail/CVE-2017-18361
• https://github.com/Pylons/colander/issues/290
• https://github.com/Pylons/colander/pull/323
• https://github.com/Pylons/colander/commit/98805557c10ab5ff3016ed09aa2d48c49b9df40b
• https://github.com/advisories/GHSA-rv95-4wxj-6fqq

Affected Packages