PYSEC-2022-42991
At a glance
- Published
- Updated
- CVE
- CVE-2022-40899
- Aliases
- GHSA-v3c5-jqr6-7qm8
Description
An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.
Affected packages
| Package | Versions |
|---|---|
| PyPI · future | introduced 0, fixed 0.18.3 |
References
- https://pypi.org/project/future/ PACKAGE
- https://github.com/python/cpython/pull/17157 EVIDENCE
- https://github.com/python/cpython/pull/17157 FIX
- https://github.com/python/cpython/pull/17157 WEB
- https://github.com/PythonCharmers/python-future/blob/master/src/future/backports/http/cookiejar.py#L215 WEB
- https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/ EVIDENCE
- https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/ ADVISORY
- https://github.com/PythonCharmers/python-future/pull/610 WEB
- https://github.com/advisories/GHSA-v3c5-jqr6-7qm8 ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |