Resource exhaustion in Python Urllib3
CVE-2020-7212
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.034 (88.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 88.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.034 · newest: 0.034 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/urllib3/urllib3/blob/master/CHANGES.rst (Third Party Advisory, Release Notes)
- github.com/urllib3/urllib3/commit/a74c9cfbaed9f811e7563cfc3dce894928e0221a (Patch, Third Party Advisory)
- pypi.org/project/urllib3/1.25.8/ (Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-7212?
- CVE-2020-7212 is a high-severity vulnerability in Python Urllib3, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2020-03-06.
- How severe is CVE-2020-7212?
- High severity. CVSS v3 base score is 7.5 out of 10.