Vulnerability · Published Mar 6, 2020 · Assigned by mitre
CVE-2020-7212
High 7.5
In plain English
A high-severity security flaw in the python-urllib3 package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-urllib3 | 1.25.8-1 | DEBIAN-CVE-2020-7212 |
| Debian:13 | python-urllib3 | 1.25.8-1 | DEBIAN-CVE-2020-7212 |
| Debian:14 | python-urllib3 | 1.25.8-1 | DEBIAN-CVE-2020-7212 |
| PyPI | urllib3 | 1.25.8 | GHSA-hmv2-79q8-fv6g |
| PyPI | urllib3 | 1.25.8 | PYSEC-2020-149 |
Affected products (as reported)
References
- https://github.com/urllib3/urllib3/blob/master/CHANGES.rst x_refsource_MISC
- https://github.com/urllib3/urllib3/commit/a74c9cfbaed9f811e7563cfc3dce894928e0221a x_refsource_MISC
- https://pypi.org/project/urllib3/1.25.8/ x_refsource_MISC