]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.13] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (GH-129355)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Mon, 27 Jan 2025 22:05:59 +0000 (23:05 +0100)
committerGitHub <noreply@github.com>
Mon, 27 Jan 2025 22:05:59 +0000 (14:05 -0800)
commit5829f7bf70c5264e5c1046667ff529926789e67d
treef2228133d8cd9ef6c8b7ff8a9dba6f8a99bcbb3c
parent247c3b26442bc344cd3426755844572a82df6799
[3.13] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (GH-129355)

gh-119511: Fix a potential denial of service in imaplib (GH-119514)

The IMAP4 client could consume an arbitrary amount of memory when trying
to connect to a malicious server, because it read a "literal" data with a
single read(size) call, and BufferedReader.read() allocates the bytes
object of the specified size before reading. Now the IMAP4 client reads data
by chunks, therefore the amount of used memory is limited by the
amount of the data actually been sent by the server.
(cherry picked from commit 735f25c5e3a0f74438c86468ec4dfbe219d93c91)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Lib/imaplib.py
Lib/test/test_imaplib.py
Misc/NEWS.d/next/Security/2024-05-24-21-00-52.gh-issue-119511.jKrXQ8.rst [new file with mode: 0644]