Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take advantage of these to cause unnecessary memory allocations in the python-engineio server. The two cases are POST requests, when using ASGI with the long polling transport and WebSocket messages, when using Aiohttp with the WebSocket transport. Version 4.13.2 addresses this issue. ASGI severs now only load the body of incoming requests into memory after the client is confirmed to be known and authenticated, and the payload size is below the maximum allowed size. Requests that do not comply with these requirements are discarded. Aiohttp servers configure the maximum payload size in the underlying WebSocket layer from Aiohttp, so that large messages are discarded by Aiohttp before they are delivered to python-engineio.
The only EPEL branch of this package is EPEL9. It’s at a significantly older version due to various compatibility reasons (dependencies, and perhaps breaking changes - I forget). The fix for this issue appears to be https://github.com/miguelgrinberg/python-engineio/commit/fc5e2f07f78a47f6442ae1ec64795ff8b6242784. It may be that this can be backported, depending on how much the code has diverged. I will investigate.
While the fix is a single-line change, it relies on some refactoring and/or fixes that occurred in between 4.4.0 and 4.14.x, and I don’t feel entirely comfortable backporting it. This is a leaf package in EPEL9, so perhaps there aren’t too many users.