]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
[3.11] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (#129357)
authorMiss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Wed, 19 Feb 2025 13:16:30 +0000 (14:16 +0100)
committerGitHub <noreply@github.com>
Wed, 19 Feb 2025 13:16:30 +0000 (14:16 +0100)
commit3abcace681e58c4c84cec9e191345a6cc58f46d9
tree090ff370607c27cf60096e0546567c23ee0584b5
parent526617ed68cde460236c973e5d0a8bad4de896ba
[3.11] gh-119511: Fix a potential denial of service in imaplib (GH-119514) (#129357)

The IMAP4 client could consume an arbitrary amount of memory when trying
to connect to a malicious server, because it read a "literal" data with a
single read(size) call, and BufferedReader.read() allocates the bytes
object of the specified size before reading. Now the IMAP4 client reads data
by chunks, therefore the amount of used memory is limited by the
amount of the data actually been sent by the server.
(cherry picked from commit 735f25c5e3a0f74438c86468ec4dfbe219d93c91)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Lib/imaplib.py
Lib/test/test_imaplib.py
Misc/NEWS.d/next/Security/2024-05-24-21-00-52.gh-issue-119511.jKrXQ8.rst [new file with mode: 0644]