REDHAT-BUG-2477154: High severity pypi/urllib3 vulnerability
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drainconn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
urllib3to a version that resolves this vulnerability.Fixed in 2.7.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477154?
The severity of REDHAT-BUG-2477154 is classified as high with a score of 7.
How does REDHAT-BUG-2477154 impact urllib3?
REDHAT-BUG-2477154 impacts urllib3 by allowing it to decompress the entire response rather than just the requested portion under certain conditions.
What versions of urllib3 are affected by REDHAT-BUG-2477154?
REDHAT-BUG-2477154 affects urllib3 versions from 2.6.0 to before 2.7.0.
How can I mitigate the risk of REDHAT-BUG-2477154?
To mitigate the risk of REDHAT-BUG-2477154, upgrade urllib3 to version 2.7.0 or later.
What is the nature of the vulnerability in REDHAT-BUG-2477154?
The nature of the vulnerability in REDHAT-BUG-2477154 involves improper handling of response data during decompression, potentially leading to exposure of sensitive information.