]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.10] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (#129358)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Wed, 19 Feb 2025 13:30:32 +0000 (14:30 +0100)
committerGitHub <noreply@github.com>
Wed, 19 Feb 2025 13:30:32 +0000 (14:30 +0100)
commit817564849e59ac5ccc4493b3596bccbb8cbfd375
treef31674c8a17c1a209d8f55d3109a86414515fd97
parent457b2cac737fa413c188480b05411942989a2366
[3.10] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (#129358)

The IMAP4 client could consume an arbitrary amount of memory when trying
to connect to a malicious server, because it read a "literal" data with a
single read(size) call, and BufferedReader.read() allocates the bytes
object of the specified size before reading. Now the IMAP4 client reads data
by chunks, therefore the amount of used memory is limited by the
amount of the data actually been sent by the server.
(cherry picked from commit 735f25c5e3a0f74438c86468ec4dfbe219d93c91)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Ɓukasz Langa <lukasz@langa.pl>
Lib/imaplib.py
Lib/test/test_imaplib.py
Misc/NEWS.d/next/Security/2024-05-24-21-00-52.gh-issue-119511.jKrXQ8.rst [new file with mode: 0644]