CVE-2020-7212 @ Python-urllib3-1.25.7

[Yoavast]

Vulnerable Package issue exists @ Python-urllib3-1.25.7 in branch main

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.24 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).

Namespace: Yoavast
Repository: CX-AST
Repository Url: https://github.com/Yoavast/CX-AST
CxAST-Project: Yoavast/CX-AST
CxAST platform scan: bab150cb-39a8-4b7b-832e-7d0f634f8d37
Branch: main
Application: CX-AST
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-400

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: NONE
Availability impact: HIGH
Remediation Upgrade Recommendation: 1.26.5

---

References
Release Note
Commit
Pull request
Advisory