]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.12] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (GH-129356)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 27 Jan 2025 22:06:14 +0000 (23:06 +0100)
committerGitHub <noreply@github.com>
Mon, 27 Jan 2025 22:06:14 +0000 (14:06 -0800)
commit2df8b395b00f01cf70a0cdad0203d784f8e62d9d
treea575c7941dcec0ae28e7316afe2b36285872b9eb
parent23faf5f2dca009f7cc18840246de405dbb7fce9f
[3.12] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (GH-129356)

gh-119511: Fix a potential denial of service in imaplib (GH-119514)

The IMAP4 client could consume an arbitrary amount of memory when trying
to connect to a malicious server, because it read a "literal" data with a
single read(size) call, and BufferedReader.read() allocates the bytes
object of the specified size before reading. Now the IMAP4 client reads data
by chunks, therefore the amount of used memory is limited by the
amount of the data actually been sent by the server.
(cherry picked from commit 735f25c5e3a0f74438c86468ec4dfbe219d93c91)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Lib/imaplib.py
Lib/test/test_imaplib.py
Misc/NEWS.d/next/Security/2024-05-24-21-00-52.gh-issue-119511.jKrXQ8.rst [new file with mode: 0644]