Bug 1812095 (CVE-2020-7212)

Summary:	CVE-2020-7212 python-urllib3: inefficient algorithm allows a DoS (CPU consumption) in _encode_invalid_chars function in util/url.py
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, aurelien, bbuckingham, bcourt, bdettelb, bkearney, bmontgom, btotty, cstratak, dbecker, eparis, hhorak, hhudgeon, hvyas, infra-sig, jburrell, jeremy, jjoyce, jokerman, jorton, jschluet, jschorr, jshepherd, kbasil, lhh, lpeer, lzap, mburns, mmccune, nstielau, puebele, python-maint, rchan, rhos-maint, rjerrido, sclewis, slinaber, sokeeffe, sponnaga, tomckay, torsava, vbellur
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	urllib3 1.25.8	Doc Type:	If docs needed, set a value
Doc Text:	If provided a specially crafted URL, urllib3 could be made to encode it using an O(N^2) algorithm, when an approximately O(N) one was possible.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-03-30 05:18:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1812102
Bug Blocks:	1812101

Description Guilherme de Almeida Suckevicz 2020-03-10 14:14:24 UTC

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).

Reference and upstream commit:
https://github.com/urllib3/urllib3/commit/4ab10abde715c7098e77686462b987586825d228

Comment 1 Guilherme de Almeida Suckevicz 2020-03-10 14:19:46 UTC

Created python-urllib3 tracking bugs for this issue:

Affects: fedora-all [bug 1812102]

Comment 2 Jason Shepherd 2020-03-11 01:04:57 UTC

OpenShift Container Platform uses urllib3-1.21.1-1, which does not include the vulnerable _encode_invalid_chars function.

Comment 5 Summer Long 2020-03-16 06:15:23 UTC

Note: flawed code was added in urllib3 1.25.2, Pull: https://github.com/urllib3/urllib3/pull/1586
Commit: https://github.com/urllib3/urllib3/commit/a74c9cfbaed9f811e7563cfc3dce894928e0221a

Comment 6 Doran Moppert 2020-03-30 05:18:30 UTC

Statement:

Red Hat Product Security does not consider this to be a vulnerability. The choice of an inefficient algorithm could cause a little more CPU time to be used than the alternative, however the difference in practice is not sufficient to cause a meaningful or even noticeable impact on the application.

Comment 7 Doran Moppert 2020-03-30 05:18:33 UTC

External References:

https://pypi.org/project/urllib3/1.25.8/
https://bugzilla.novell.com/show_bug.cgi?id=1166069