]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Wed, 17 Jul 2019 17:13:54 +0000 (10:13 -0700)
committerGitHub <noreply@github.com>
Wed, 17 Jul 2019 17:13:54 +0000 (10:13 -0700)
commit6816ca30af7705db691343100e696ea3d8f447d5
tree76a3242a232faa62d275f5ecc42087d1b79f2188
parent1fc43a3fafd22eb20832459654fd125f12aa3738
bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794)

* bpo-37461: Fix infinite loop in parsing of specially crafted email headers.

Some crafted email header would cause the get_parameter method to run in an
infinite loop causing a DoS attack surface when parsing those headers. This
patch fixes that by making sure the DQUOTE character is handled to prevent
going into an infinite loop.
(cherry picked from commit a4a994bd3e619cbaff97610a1cee8ffa87c672f5)

Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>
Lib/email/_header_value_parser.py
Lib/test/test_email/test__header_value_parser.py
Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst [new file with mode: 0644]