Bug 1926885 (CVE-2021-21240)
| Summary: | CVE-2021-21240 python-httplib2: Regular expression denial of service via malicious header | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | amctagga, andreas.bierfert, anharris, askrabec, bkearney, bniver, cluster-maint, dbecker, dchen, flucifre, gmeno, gwync, hvyas, igor.raits, jjoyce, jschluet, jspaleta, kaycoth, kevin, lhh, lpeer, mbenjamin, mburns, mcascell, mhackett, oalbrigt, pcahyna, puebele, rhos-maint, sclewis, slinaber, sostapov, vereddy |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | httplib2 0.19.0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
An uncontrolled resource consumption flaw as found in python-httplib2, due to a flawed regular expression used while parsing the WWW-Authenticate header in an HTTP response. This flaw allows a malicious or compromised server to reply with a crafted sequence of characters in the WWW-Authenticate header, leading to a denial of service of the httplib2 client accessing the server. The highest threat from this vulnerability is to system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-05-26 17:32:04 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1926886, 1929179, 1929408, 1930186, 1931438, 1931550, 1931678 | ||
| Bug Blocks: | 1926887 | ||
|
Description
Pedro Sampaio
2021-02-09 15:44:37 UTC
Created python-httplib2 tracking bugs for this issue: Affects: fedora-all [bug 1926886] Setting ceph2 to OOSS. Created python-httplib2 tracking bugs for this issue: Affects: epel-7 [bug 1929179] External References: https://github.com/httplib2/httplib2/security/advisories/GHSA-93xj-8mrv-444m Mitigation: Use strict mode to parse WWW-Authenticate headers. This can be done by setting `httplib2.USE_WWW_AUTH_STRICT_PARSING = True`. Please note, however, that strict mode might lead to bad results in case of ill-formed header values. RHUI still uses python2, which does not seem to suffer from the same DoS when searching a string with the flawed regular expression. A ValueError is raised instead, which is caught and re-raised as MalformedHeader exception. The flaw exists in the WWW_AUTH_RELAXED regexp pattern `\s*[^ \t\r\n=]+\s*=` used to parse the WWW-Authenticate HTTP response header. As mentioned in the upstream advisory, a long sequence of '\xa0' characters may cause catastrophic backtracking, making the client susceptible to a ReDoS attack when it receives specially crafted responses from a malicious or compromised server. The main reason is that backtracking requires the regular expression engine to enumerate all possible solutions, which makes the operation very expensive as it has an exponential cost. Therefore, when the server sends a crafted bogus value, the client will take a very long time to parse the response, potentially causing a denial of service. Statement: This flaw has been rated as having a security impact of Low, because it requires a malicious or compromised server in order to be exploited, and it only affects the HTTP client. In Red Hat OpenStack Platform 13, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP 13 python-httplib2 package. This issue has been addressed in the following products: Red Hat OpenStack Platform 16.1 Via RHSA-2021:2116 https://access.redhat.com/errata/RHSA-2021:2116 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-21240 |