]> granicus.if.org Git - python/commit
[3.5] bpo-37461: Fix infinite loop in parsing of specially crafted email headers...
authorAbhilash Raj <maxking@users.noreply.github.com>
Sat, 7 Sep 2019 07:08:53 +0000 (00:08 -0700)
committerlarryhastings <larry@hastings.org>
Sat, 7 Sep 2019 07:08:53 +0000 (08:08 +0100)
commitc28e4a5160d3283b12514c7c28ed6e0a2a52271a
tree3be5666497756a91d3eb2a411ee559a07605e7ac
parent095373c32d16df575ba5fcb5f44bf44119b26193
[3.5] bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794) (#15446)

* [3.5] bpo-37461: Fix infinite loop in parsing of specially crafted email headers (GH-14794)

Some crafted email header would cause the get_parameter method to run in an
infinite loop causing a DoS attack surface when parsing those headers. This
patch fixes that by making sure the DQUOTE character is handled to prevent
going into an infinite loop.
(cherry picked from commit a4a994bd3e619cbaff97610a1cee8ffa87c672f5)

Co-authored-by: Abhilash Raj <maxking@users.noreply.github.com>
Co-Authored-By: Ashwin Ramaswami <aramaswamis@gmail.com>
Lib/email/_header_value_parser.py
Lib/test/test_email/test__header_value_parser.py
Misc/NEWS.d/next/Security/2019-07-16-08-11-00.bpo-37461.1Ahz7O.rst [new file with mode: 0644]