urllib3 Library up to 1.25.7 on Python util/url.py encode_invalid_chars resource consumption

Summaryinfo

A vulnerability was found in urllib3 Library up to 1.25.7 on Python. It has been rated as problematic. This affects the function encode_invalid_chars of the file util/url.py. The manipulation leads to resource consumption. This vulnerability is listed as CVE-2020-7212. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in urllib3 Library up to 1.25.7 on Python (Software Library). It has been rated as problematic. This issue affects the function encode_invalid_chars of the file util/url.py. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).

The weakness was presented 03/06/2020. The identification of this vulnerability is CVE-2020-7212 since 01/16/2020. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Software Library

Name

• urllib3 Library

Version

• 1.25.2
• 1.25.3
• 1.25.4
• 1.25.5
• 1.25.6
• 1.25.7

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion