Skip to content

3.4.2

Choose a tag to compare

View all tags
@Zeecka Zeecka released this 11 Jul 17:42
· 35 commits to main since this release
3.4.2
891c4bc

Security fix

Bounds the PNG DOS→Unix repair search in aperisolve/utils/png.py (_fix_dos2unix) to prevent a CPU-exhaustion denial of service (CWE-407 / CWE-400).

Previously, a malformed IDAT chunk could force a C(len(pos_list), count) CRC search with both parameters taken straight from the uploaded file and no upper bound, letting a sub-100-byte upload pin a worker core until the RQ job timeout. The search is now bounded by insertion count, combination count (math.comb checked up front), and a short wall-clock budget. Genuine CRLF→LF manglings are still recovered.

Severity: Medium — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3). Impact is limited by per-IP upload rate limiting and the RQ job timeout.

Adds regression tests (tests/test_png_repair.py) covering both the rejection and recovery paths.

Assets 2
Loading