Skip to content

A Series of Simple DOS Vulnerabilities #134873

Closed as duplicate
Closed as duplicate
A Series of Simple DOS Vulnerabilities#134873
Assignees
serhiy-storchakapicnixz
Labels
3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.9 (EOL)end of lifependingThe issue will be closed if no feedback is providedstdlibStandard Library Python modules in the Lib/ directorytopic-emailtopic-pathlibtype-securityA security issue

Description

@kexinoh
kexinoh
opened on May 29, 2025

Bug report

Update

Now, based on the specific location where the problem code appears, it has been re-split into five issues.

Bug description:

We have identified a series of simple quadratic complexity vulnerabilities. After confirmation by CPython's security team, since these DOS vulnerabilities pose a low threat and are relatively tedious to exploit, we can directly initiate requests in issues to seek assistance from the community for fixes.
Below are the specific locations of the different complexity issues we discovered.

1.

cpython/Lib/posixpath.py

Line 290 in f49a07b

def expandvars(path):

2.

cpython/Lib/email/message.py

Line 73 in 5ab66a8

def _parseparam(s):

3.

cpython/Lib/idlelib/editor.py

Line 1206 in 5ab66a8

while methodname[:1] == '<':

4.

cpython/Lib/email/_header_value_parser.py

Line 1424 in 5ab66a8

def get_phrase(value):

5.

cpython/Lib/email/_header_value_parser.py

Line 1506 in 5ab66a8

while value and (value[0]=='\\' or value[0] not in PHRASE_ENDS):

6.

cpython/Lib/email/_header_value_parser.py

Line 1688 in 5ab66a8

value = value[1:]

7.

cpython/Lib/email/_header_value_parser.py

Line 1697 in 5ab66a8

value = value[1:]

8.

cpython/Lib/email/_header_value_parser.py

Line 1847 in 5ab66a8

value = value[1:]

9.

cpython/Lib/email/_header_value_parser.py

Line 2200 in 5ab66a8

value = value[1:]

10.

cpython/Lib/email/_header_value_parser.py

Line 2231 in 5ab66a8

value = value[1:]

11.

cpython/Lib/email/_header_value_parser.py

Line 2260 in 5ab66a8

value = value[1:]

12.

cpython/Lib/email/_header_value_parser.py

Line 2411 in 5ab66a8

value = value[1:]

13.

cpython/Lib/email/_header_value_parser.py

Line 2570 in 5ab66a8

value = value[1:]

14.

cpython/Lib/email/_header_value_parser.py

Line 2642 in 5ab66a8

value = value[1:]

15.

cpython/Lib/email/_header_value_parser.py

Line 2762 in 5ab66a8

value = value[1:]

16.

cpython/Lib/email/_header_value_parser.py

Line 2965 in 5ab66a8

to_encode = to_encode[1:]

17.

cpython/Tools/freeze/checkextensions.py

Line 72 in e64395e

def expandvars(str, vars):

18.

cpython/Lib/ntpath.py

Line 403 in cb8a72b

def expandvars(path):

19.

cpython/Lib/idlelib/editor.py

Line 1373 in 5ab66a8

while True:

20.

cpython/Lib/idlelib/editor.py

Line 1454 in 98a5b83

while line and line[-1] in " \t":

21.

cpython/Lib/platform.py

Line 642 in 98a5b83

while platform and platform[-1] == '-':

Current repair status:

03/19 has been fixed. @johnzhou721
1 has been fixed. @Wulian233
2/4/5/6/7/8/9/10/11/12/13/14/15/16 has been fixed. @picnixz
1/18 has been fixed. @serhiy-storchaka

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Credits

Finder is kexinoh (Xiangfan Wu) from QI-ANXIN Technology Research Institute.

Linked PRs

Activity

  1. kexinoh
    added
    type-bugAn unexpected behavior, bug, or error
    on May 29, 2025
  2. ZeroIntensity
    added
    type-securityA security issue
    3.11only security fixes
    3.10 (EOL)end of life
    3.9 (EOL)end of life
    topic-email
    3.12only security fixes
    3.13only security fixes
    3.14bugs and security fixes
    and removed
    type-bugAn unexpected behavior, bug, or error
    on May 29, 2025

  3. johnzhou721 commented on May 29, 2025

    @johnzhou721
    johnzhou721
    on May 29, 2025 · Hidden as outdated

  4. johnzhou721 commented on May 29, 2025

    @johnzhou721
    johnzhou721
    on May 29, 2025 · Hidden as outdated

  5. johnzhou721 commented on May 29, 2025

    @johnzhou721
    johnzhou721
    on May 29, 2025 · Hidden as resolved

  6. kexinoh commented on May 29, 2025

    @kexinoh
    kexinoh
    on May 29, 2025
    Author

    Okay, I will maintain a note in the issue regarding the completed repair part. I hope others can complete the remaining sections.

  7. ZeroIntensity commented on May 29, 2025

    @ZeroIntensity
    ZeroIntensity
    on May 29, 2025
    Member

    cc @sethmlarson I'm assuming you're aware of this

    After confirmation by CPython's security team

  8. 18 remaining items

  9. johnzhou721 commented on Jun 22, 2025

    @johnzhou721
    johnzhou721
    on Jun 22, 2025
    Contributor

    FYI: 19 is potentially non-exploitable if we can limit the maximum of indentwidth when loading the config (What's the difference between self.indentwidth and self.tabwidth in the editor anyways?)

  10. serhiy-storchaka commented on Jun 28, 2025

    @serhiy-storchaka
    serhiy-storchaka
    on Jun 28, 2025
    Member

    Please open separate issue for each problem. os.path, IDLE, email -- they all are very different and need different solutions.

  11. serhiy-storchaka
    added
    pendingThe issue will be closed if no feedback is provided
    on Jun 28, 2025

  12. kexinoh commented on Jun 28, 2025

    @kexinoh
    kexinoh
    on Jun 28, 2025 via email
    Author

  13. kexinoh commented on Jun 28, 2025

    @kexinoh
    kexinoh
    on Jun 28, 2025
    Author

    I have added fout new issues.
    #136061
    #136063
    #136065
    #136066

  14. StanFromIreland commented on Jun 28, 2025

    @StanFromIreland
    StanFromIreland
    on Jun 28, 2025
    Member

    Is there any left here or can this be closed now?

  15. picnixz commented on Jun 28, 2025

    @picnixz
    picnixz
    on Jun 28, 2025 · Hidden as outdated

  16. picnixz commented on Jun 28, 2025

    @picnixz
    picnixz
    on Jun 28, 2025
    Member

    Actually no, please open issues for platform and tools (or maybe it's under the os.path issue) as well.

  17. picnixz commented on Jun 28, 2025

    @picnixz
    picnixz
    on Jun 28, 2025
    Member

    The platform issue is actually straightforward and I can take care of it now.

  18. kexinoh commented on Jun 28, 2025

    @kexinoh
    kexinoh
    on Jun 28, 2025
    Author

    I updated it at the top of this issue to indicate that it has been split, which will help readers understand it quickly.

    Ok. I put them in the PATH. Now it seems that it can be turned off.

  19. picnixz commented on Jun 28, 2025

    @picnixz
    picnixz
    on Jun 28, 2025
    Member

    No I meant, the platform one is separate from the path issues. But the checkextensions one is a path-one as it's expandvars-related

  20. kexinoh commented on Jun 28, 2025

    @kexinoh
    kexinoh
    on Jun 28, 2025
    Author

    #136066 @picnixz

  21. picnixz commented on Jun 28, 2025

    @picnixz
    picnixz
    on Jun 28, 2025
    Member

    Thanks. We'll close this issue in particular and focus on the dedicated ones instead. Thanks for the report.

  22. picnixz
    closed this as duplicateon Jun 28, 2025
  23. terryjreedy
    removed
    topic-IDLE
    on Nov 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.9 (EOL)end of lifependingThe issue will be closed if no feedback is providedstdlibStandard Library Python modules in the Lib/ directorytopic-emailtopic-pathlibtype-securityA security issue

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions