Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport fix for bpo-38804 #610

Merged
merged 1 commit into from Jan 12, 2023
Merged

Backport fix for bpo-38804 #610

merged 1 commit into from Jan 12, 2023

Commits on Dec 23, 2022

  1. Backport fix for bpo-38804 

    The regex http.cookiejar.LOOSE_HTTP_DATE_RE was vulnerable to regular
expression denial of service (REDoS). The regex contained multiple
overlapping \s* capture groups. A long sequence of spaces can trigger
bad performance.

See python/cpython#17157 and https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
    @wshanks
    wshanks committed Dec 23, 2022
    Copy the full SHA
    c91d70b View commit details
    Browse the repository at this point in the history