python backports ssl_match_hostname Resource Exhaustion 0day

2013-05-15 / 2013-05-17
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-399

A denial of service flaw was found in the way python-backports-ssl_match_hostname, an implementation that brings the ssl.match_hostname() function from Python 3.2 to users of earlier versions of Python, performed matching of the certificate's name in the case it contained many '*' wildcard characters. A remote attacker, able to obtain valid certificate [*] with its name containing a lot of '*' wildcard characters, could use this flaw to cause denial of service (excessive CPU time consumption) by issuing request to validate that certificate for / in an application using the python-backports-ssl_match_hostname functionality. Upstream bug report (no patch yet): [1] http://bugs.python.org/issue17980 References: [2] https://bugzilla.redhat.com/show_bug.cgi?id=963186 Credit: Issue was found by Florian Weimer of Red Hat Product Security Team

References:

https://bugzilla.redhat.com/show_bug.cgi?id=963186
http://bugs.python.org/issue17980


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top