GHSA-VQHP-CXGC-6WMM高危已审查

regular expression denial-of-service (ReDoS) in Bleach

OSV 1.4.0 · github-reviewed · 修改于 2025-03-21 02:49

发布时间

2020-03-31 03:45

GitHub 审查时间

2020-03-28 03:58

NVD 发布时间

2023-02-17 06:15

源文件

advisories/github-reviewed/2020/03/GHSA-vqhp-cxgc-6wmm/GHSA-vqhp-cxgc-6wmm.json

公告说明

Impact

bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).

Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

Patches

3.1.4

Workarounds

do not whitelist the style attribute in bleach.clean calls
limit input string length

References

Credits

Reported by schwag09 of r2c

For more information

If you have any questions or comments about this advisory:

Open an issue at https://github.com/mozilla/bleach/issues
Email us at [email protected]

受影响的软件包

标识信息

别名 / CVE

CVE-2020-6817

CWE

CWE-1333CWE-400

软件生态

PyPI

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-vqhp-cxgc-6wmm",
  "aliases": [
    "CVE-2020-6817"
  ],
  "details": "### Impact\n\n`bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).\n\nCalls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute are vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={'a': ['style']})``.\n\n### Patches\n\n3.1.4\n\n### Workarounds\n\n* do not whitelist the style attribute in `bleach.clean` calls\n\n* limit input string length\n\n### References\n\n* https://bugzilla.mozilla.org/show_bug.cgi?id=1623633\n* https://www.regular-expressions.info/redos.html\n* https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/\n* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817\n\n### Credits\n\n* Reported by schwag09 of r2c\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue at https://github.com/mozilla/bleach/issues\n* Email us at [email protected]",
  "summary": "regular expression denial-of-service (ReDoS) in Bleach",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.4"
            }
          ]
        }
      ],
      "package": {
        "name": "bleach",
        "ecosystem": "PyPI"
      }
    }
  ],
  "modified": "2025-03-20T18:49:18Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2020-03-30T19:45:56Z",
  "references": [
    {
      "url": "https://github.com/mozilla/bleach/security/advisories/GHSA-vqhp-cxgc-6wmm",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6817",
      "type": "ADVISORY"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1623633",
      "type": "WEB"
    },
    {
      "url": "https://github.com/mozilla/bleach",
      "type": "PACKAGE"
    },
    {
      "url": "https://github.com/mozilla/bleach/releases/tag/v3.1.4",
      "type": "WEB"
    },
    {
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/bleach/PYSEC-2020-340.yaml",
      "type": "WEB"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-PYTHON-BLEACH-561754",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-1333",
      "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": "2023-02-16T22:15:00Z",
    "github_reviewed_at": "2020-03-27T19:58:38Z"
  }
}