Skip to content

/ cpython

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[3.9] bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (GH-25916) #25932

Merged
merged 1 commit into from May 5, 2021
Merged

[3.9] bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (GH-25916) #25932

merged 1 commit into from May 5, 2021

Conversation

@miss-islington
Copy link
Contributor

@miss-islington miss-islington commented May 5, 2021 •
edited

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith greg@krypto.org
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu xgbarry@gmail.com

https://bugs.python.org/issue44022

Automerge-Triggered-By: GH:gpshead
@gen-xu @miss-islington
bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 1…
96a983c 
…00 Continue (GH-25916)

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu <xgbarry@gmail.com>
@bedevere-bot bedevere-bot mentioned this pull request May 5, 2021
Merged
@miss-islington
Copy link
Contributor Author

@miss-islington miss-islington commented May 5, 2021

@gen-xu and @gpshead: Status check is done, and it's a success ✅ .
@gpshead
gpshead approved these changes May 5, 2021
View changes
@miss-islington
Copy link
Contributor Author

@miss-islington miss-islington commented May 5, 2021

@gen-xu and @gpshead: Status check is done, and it's a success ✅ .
@miss-islington miss-islington merged commit ea93270 into python:3.9 May 5, 2021
14 checks passed
14 checks passed
@github-actions
Docs
Details
@github-actions
Check for source changes
Details
@github-actions
Check if the ABI has changed
Details
@github-actions
Check if generated files are up to date
Details
@github-actions
Windows (x86)
Details
@github-actions
Windows (x64)
Details
@github-actions
macOS
Details
@github-actions
Ubuntu
Details
@github-actions
Ubuntu SSL tests with OpenSSL
Details
Azure Pipelines PR #20210505.49 succeeded
Details
@travis-ci
Travis CI - Pull Request Build Passed
Details
@bedevere-bot
bedevere/issue-number Issue number 44022 found
Details
@bedevere-bot
bedevere/maintenance-branch-pr Valid maintenance branch PR title.
@bedevere-bot
bedevere/news News entry found in Misc/NEWS.d
@miss-islington miss-islington deleted the miss-islington:backport-47895e3-3.9 branch May 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gpshead gpshead

Assignees
No one assigned
Labels
🤖 automerge CLA signed type-bugfix type-security
Projects
None yet
Milestone
No milestone
5 participants
@miss-islington @gpshead @the-knights-who-say-ni @bedevere-bot @gen-xu