bpo-44022: Fix http client infinite line reading (DoS) after a http 100 by gen-xu · Pull Request #25916 · python/cpython

gen-xu · 2021-05-05T11:13:10Z

https://bugs.python.org/issue44022

the-knights-who-say-ni · 2021-05-05T11:13:13Z

Hello, and thanks for your contribution!

I'm a bot set up to make sure that the project can legally accept this contribution by verifying everyone involved has signed the PSF contributor agreement (CLA).

Recognized GitHub username

We couldn't find a bugs.python.org (b.p.o) account corresponding to the following GitHub usernames:

@gen-nimble

This might be simply due to a missing "GitHub Name" entry in one's b.p.o account settings. This is necessary for legal reasons before we can look at this contribution. Please follow the steps outlined in the CPython devguide to rectify this issue.

CLA Missing

Our records indicate the following people have not signed the CLA:

@gen-xu

For legal reasons we need all the people listed to sign the CLA before we can look at your contribution. Please follow the steps outlined in the CPython devguide to rectify this issue.

If you have recently signed the CLA, please wait at least one business day
before our records are updated.

You can check yourself to see if the CLA has been received.

Thanks again for the contribution, we look forward to reviewing it!

…check after 100

bedevere-bot · 2021-05-05T20:00:10Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

gen-xu · 2021-05-05T21:20:10Z

I have made the requested changes; please review again

bedevere-bot · 2021-05-05T21:20:13Z

Thanks for making the requested changes!

@gpshead: please review the changes made to this pull request.

gpshead

I made a few minor edit updates to the PR. Now we wait for the CI testing runs to finish. :)

miss-islington · 2021-05-05T22:42:43Z

Thanks @gen-xu for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.6, 3.7, 3.8, 3.9.
🐍🍒⛏🤖

bedevere-bot · 2021-05-05T22:42:52Z

GH-25931 is a backport of this pull request to the 3.10 branch.

bedevere-bot · 2021-05-05T22:42:57Z

GH-25932 is a backport of this pull request to the 3.9 branch.

…00 Continue (pythonGH-25916) Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response. Co-authored-by: Gregory P. Smith <greg@krypto.org> (cherry picked from commit 47895e3) Co-authored-by: Gen Xu <xgbarry@gmail.com>

bedevere-bot · 2021-05-05T22:43:03Z

GH-25933 is a backport of this pull request to the 3.8 branch.

…00 Continue (pythonGH-25916) Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response. Co-authored-by: Gregory P. Smith <greg@krypto.org> (cherry picked from commit 47895e3) Co-authored-by: Gen Xu <xgbarry@gmail.com>

bedevere-bot · 2021-05-05T22:43:08Z

GH-25934 is a backport of this pull request to the 3.7 branch.

…00 Continue (pythonGH-25916) Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response. Co-authored-by: Gregory P. Smith <greg@krypto.org> (cherry picked from commit 47895e3) Co-authored-by: Gen Xu <xgbarry@gmail.com>

bedevere-bot · 2021-05-05T22:43:15Z

GH-25935 is a backport of this pull request to the 3.6 branch.

…00 Continue (GH-25916) Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response. Co-authored-by: Gregory P. Smith <greg@krypto.org> (cherry picked from commit 47895e3) Co-authored-by: Gen Xu <xgbarry@gmail.com>

…00 Continue (GH-25916) (GH-25931) Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response. Co-authored-by: Gregory P. Smith <greg@krypto.org> (cherry picked from commit 47895e3) Co-authored-by: Gen Xu <xgbarry@gmail.com>

…00 Continue (GH-25916) (#25933) Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response. Co-authored-by: Gregory P. Smith <greg@krypto.org> (cherry picked from commit 47895e3) Co-authored-by: Gen Xu <xgbarry@gmail.com>

…00 Continue (GH-25916) (GH-25935) Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response. Co-authored-by: Gregory P. Smith <greg@krypto.org> (cherry picked from commit 47895e3) Co-authored-by: Gen Xu <xgbarry@gmail.com>

…00 Continue (GH-25916) (GH-25934) Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response. Co-authored-by: Gregory P. Smith <greg@krypto.org> (cherry picked from commit 47895e3) Co-authored-by: Gen Xu <xgbarry@gmail.com>

… a HTTP 100 Continue (pythonGH-25916) Backport the fix from the following commit: commit 47895e3 Author: Gen Xu <xgbarry@gmail.com> Date: 2021-05-06 00:42:41 +0200 bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (pythonGH-25916) Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response. Co-authored-by: Gregory P. Smith <greg@krypto.org> Instead of reusing the header reading code, I have just added explicit counter to avoid having to refactor the old code. Plus the improved test from: commit e60ab84 Author: Gregory P. Smith <greg@krypto.org> Date: 2021-06-03 05:43:38 +0200 bpo-44022: Improve the regression test. (pythonGH-26503) It wasn't actually detecting the regression due to the assertion being too lenient.

easyteacher · 2021-08-10T01:18:42Z

Can you apply for a CVE? I think this bug is still a little serious.

ajakk · 2022-03-05T16:25:39Z

Redhat issues CVEs for CPython (though I don't think this is actually documented anywhere. They've assigned CVE-2021-3737.

bedevere-bot added the awaiting review label May 5, 2021

the-knights-who-say-ni added the CLA not signed label May 5, 2021

bpo-44022: Fix httplib client deny of service with total header size …
e53f243
…check after 100

gen-xu force-pushed the fix-issue-44022 branch from cc46630 to e53f243Compare May 5, 2021 11:22

the-knights-who-say-ni added CLA signed and removed CLA not signed labels May 5, 2021

📜🤖 Added by blurb_it.
55206e1

gen-xu changed the title ~~bpo-44022: Fix httplib client deny of service with total header size check after 100.~~bpo-44022: Fix httplib client deny of service with total header size check after http 100.May 5, 2021

gpshead requested changes May 5, 2021
View reviewed changes

Comment threadLib/http/client.py Outdated

bedevere-bot added awaiting changes and removed awaiting review labels May 5, 2021

gpshead added needs backport to 3.9 needs backport to 3.10 only security fixes type-bug An unexpected behavior, bug, or error labels May 5, 2021

gpshead changed the title ~~bpo-44022: Fix httplib client deny of service with total header size check after http 100.~~bpo-44022: Fix http client infinite line reading (DoS) after a http 100May 5, 2021

gpshead self-assigned this May 5, 2021

gen-xu added 2 commits May 5, 2021 14:04

Using provided header reads function to skip.
d1ac02b

Fix test_all.
362c50d

bedevere-bot added awaiting change review and removed awaiting changes labels May 5, 2021

bedevere-bot requested a review from gpshead May 5, 2021 21:20

gpshead added 3 commits May 5, 2021 14:48

renamed the new function to _read_headers to keep it private.
17941e8

no need to exclude read_headers in test_all now.
5ce1a31

reword and add ReST formatting.
859cd6e

gpshead added needs backport to 3.6 labels May 5, 2021

gpshead added the needs backport to 3.8 label May 5, 2021

gpshead approved these changes May 5, 2021
View reviewed changes

bedevere-bot added awaiting merge and removed awaiting change review labels May 5, 2021

gpshead merged commit 47895e3 into python:mainMay 5, 2021

bedevere-bot removed the awaiting merge label May 5, 2021

bedevere-bot removed the needs backport to 3.10 only security fixes label May 5, 2021

bedevere-bot removed the needs backport to 3.9 label May 5, 2021

bedevere-bot removed the needs backport to 3.8 label May 5, 2021

bedevere-bot removed the needs backport to 3.7 label May 5, 2021

bedevere-bot removed the needs backport to 3.6 label May 5, 2021

pablogsal mentioned this pull request Jul 18, 2021
[3.10] Correct the order of regen-abidump #27228
Closed

Uh oh!

Uh oh!

Conversation

gen-xu commented May 5, 2021• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

the-knights-who-say-ni commented May 5, 2021

Recognized GitHub username

CLA Missing

Uh oh!

Uh oh!

bedevere-bot commented May 5, 2021

Uh oh!

gen-xu commented May 5, 2021

Uh oh!

bedevere-bot commented May 5, 2021

Uh oh!

gpshead left a comment

Choose a reason for hiding this comment

Uh oh!

miss-islington commented May 5, 2021

Uh oh!

bedevere-bot commented May 5, 2021

Uh oh!

bedevere-bot commented May 5, 2021

Uh oh!

bedevere-bot commented May 5, 2021

Uh oh!

bedevere-bot commented May 5, 2021

Uh oh!

bedevere-bot commented May 5, 2021

Uh oh!

easyteacher commented Aug 10, 2021

Uh oh!

ajakk commented Mar 5, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

gen-xu commented May 5, 2021•
edited
Loading