GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-123067: Fix quadratic complexity in parsing cookies with backslashes by serhiy-storchaka · Pull Request #123075 · python/cpython

Conversation

serhiy-storchaka commented Aug 16, 2024 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

This fixes CVE-2024-7592.

Issue: CVE-2024-7592: Denial of Service Vulnerability in http.cookies._unquote() #123067

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

serhiy-storchaka added type-security

A security issue

needs backport to 3.8 needs backport to 3.11

only security fixes

needs backport to 3.12

only security fixes

needs backport to 3.13 only security fixes labels

Aug 16, 2024

bedevere-app Bot mentioned this pull request

Aug 16, 2024

CVE-2024-7592: Denial of Service Vulnerability in http.cookies._unquote() #123067

Closed

bedevere-app Bot added the awaiting core review label

Aug 16, 2024


          pythongh-123067: Fix quadratic complexity in parsing cookies with bac…

04ac47b

…kslashes

This fixes CVE-2024-7592.

serhiy-storchaka force-pushed the http-coockies-optimize-re branch from 73e2aa9 to 04ac47b Compare

August 16, 2024 16:22

serhiy-storchaka mentioned this pull request

Aug 16, 2024

gh-123067: Denial of Service Vulnerability in http.cookies._unquote() #123066

Closed

serhiy-storchaka commented

Aug 16, 2024

View reviewed changes

Comment thread

Lib/test/test_http_cookies.py Resolved

Uh oh!

There was an error while loading. Please reload this page.


          Restore the current behavior for backslash-escaping.

ab87c99

picnixz reviewed

Aug 16, 2024

View reviewed changes

Comment thread

Lib/http/cookies.py Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread

Misc/NEWS.d/next/Library/2024-08-16-19-13-21.gh-issue-123067.Nx9O4R.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.

sethmlarson approved these changes

Aug 16, 2024

View reviewed changes

sethmlarson left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ran the new tests with and without the changes, the approach looks good to me! Thanks @serhiy-storchaka! 🙏

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

serhiy-storchaka added 2 commits

August 17, 2024 12:40


          Cache the sub() method, not the compiled pattern object.

1fe2492


          Add a reference to the module in NEWS.

8256ed2

picnixz approved these changes

Aug 17, 2024

View reviewed changes

serhiy-storchaka merged commit 44e4583 into python:main

Aug 17, 2024

miss-islington-app Bot commented Aug 17, 2024

Copy link

Copy Markdown

Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.8, 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting core review label

Aug 17, 2024

serhiy-storchaka deleted the http-coockies-optimize-re branch

August 17, 2024 13:30

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Aug 17, 2024


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

70390bb

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

bedevere-app Bot commented Aug 17, 2024

Copy link

Copy Markdown

GH-123103 is a backport of this pull request to the 3.13 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Aug 17, 2024


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

6a33a68

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

bedevere-app Bot removed the needs backport to 3.13 only security fixes label

Aug 17, 2024

bedevere-app Bot commented Aug 17, 2024

Copy link

Copy Markdown

GH-123104 is a backport of this pull request to the 3.12 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.12 only security fixes label

Aug 17, 2024

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Aug 17, 2024


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

dcfd909

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

bedevere-app Bot commented Aug 17, 2024

Copy link

Copy Markdown

GH-123105 is a backport of this pull request to the 3.11 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label

Aug 17, 2024

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Aug 17, 2024


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

c4412d3

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

bedevere-app Bot commented Aug 17, 2024

Copy link

Copy Markdown

GH-123106 is a backport of this pull request to the 3.10 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.10 label

Aug 17, 2024

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Aug 17, 2024


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

15eec9d

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

bedevere-app Bot commented Aug 17, 2024

Copy link

Copy Markdown

GH-123107 is a backport of this pull request to the 3.9 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.9 label

Aug 17, 2024

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request

Aug 17, 2024


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

fa88d41

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

bedevere-app Bot commented Aug 17, 2024

Copy link

Copy Markdown

GH-123108 is a backport of this pull request to the 3.8 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.8 label

Aug 17, 2024

jeremyhylton pushed a commit to jeremyhylton/cpython that referenced this pull request

Aug 19, 2024


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

rickprice added a commit to ActiveState/cpython that referenced this pull request

Aug 21, 2024


          CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie

6755e54

pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

rickprice added a commit to ActiveState/cpython that referenced this pull request

Aug 22, 2024


          CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie

ed12fce

pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

Redo tests without a subtest

Backport how RegEx stuff is handled to Python2

rickprice added a commit to ActiveState/cpython that referenced this pull request

Aug 22, 2024


          CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie

096104d

pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

rickprice mentioned this pull request

Aug 22, 2024

CVE-2024-7592 Fix quadratic complexity in parsing quoted cookie ActiveState/cpython#62

Merged

blhsing pushed a commit to blhsing/cpython that referenced this pull request

Aug 22, 2024


          pythongh-123067: Fix quadratic complexity in parsing "-quoted cookie …

f619de1

…values with backslashes (pythonGH-123075)

This fixes CVE-2024-7592.

Akendo added a commit to gardenlinux/package-python3.12 that referenced this pull request

Aug 22, 2024


          Include upstream patch for python for CVE-2024-7592

031f522

We create a patch from the PR on GitHub that address the vulerability.

python/cpython#123075

Akendo mentioned this pull request

Aug 22, 2024

Include upstream patch for python for CVE-2024-7592 gardenlinux/package-python3.12#1

Closed

hauntsaninja pushed a commit that referenced this pull request

Aug 24, 2024


          [3.13] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

391e562

… values with backslashes (GH-123075) (#123103)

gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

hauntsaninja pushed a commit that referenced this pull request

Aug 24, 2024


          [3.12] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

dcc3eae

… values with backslashes (GH-123075) (#123104)

gh-123067: Fix quadratic complexity in parsing "-quoted cookie values with backslashes (GH-123075)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

ambv pushed a commit that referenced this pull request

Sep 4, 2024


          [3.8] gh-123067: Fix quadratic complexity in parsing "-quoted cookie …

a77ab24

…values with backslashes (GH-123075) (#123108)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

ambv pushed a commit that referenced this pull request

Sep 4, 2024


          [3.9] gh-123067: Fix quadratic complexity in parsing "-quoted cookie …

d662e2d

…values with backslashes (GH-123075) (#123107)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

ambv pushed a commit that referenced this pull request

Sep 4, 2024


          [3.11] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

d4ac921

… values with backslashes (GH-123075) (#123105)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

ambv pushed a commit that referenced this pull request

Sep 4, 2024


          [3.10] gh-123067: Fix quadratic complexity in parsing "-quoted cookie…

b2f11ca

… values with backslashes (GH-123075) (#123106)

This fixes CVE-2024-7592.
(cherry picked from commit 44e4583)

Co-authored-by: Serhiy Storchaka <[email protected]>

vEpiphyte mentioned this pull request

Dec 19, 2024

Add http.coookies monkeypatch (SYN-8465) vertexproject/synapse#4045

Merged

vEpiphyte added a commit to vertexproject/synapse that referenced this pull request

Dec 31, 2024


          Add http.coookies monkeypatch (SYN-8465) (#4045)

746605b

Vendor the fixes from CPython for
GHSA-7pwv-g7hj-39pr and applies them at
import time of `synapse.common`.

python/cpython#123067
python/cpython#123075

sajjaphani mentioned this pull request

May 19, 2025

[Security] Vulnerability found in Security vulnerability CVE-2024-7592 in package python habitat-sh/foundational-packages#64

Closed

Reviewers

sethmlarson

sethmlarson approved these changes

picnixz

picnixz approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

type-security

A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

serhiy-storchaka commented Aug 16, 2024 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sethmlarson left a comment

Choose a reason for hiding this comment

Uh oh!

miss-islington-app Bot commented Aug 17, 2024

Uh oh!

bedevere-app Bot commented Aug 17, 2024

Uh oh!

bedevere-app Bot commented Aug 17, 2024

Uh oh!

bedevere-app Bot commented Aug 17, 2024

Uh oh!

bedevere-app Bot commented Aug 17, 2024

Uh oh!

bedevere-app Bot commented Aug 17, 2024

Uh oh!

bedevere-app Bot commented Aug 17, 2024

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

serhiy-storchaka commented Aug 16, 2024 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.