-
Notifications
You must be signed in to change notification settings - Fork 91
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Reproducer for CVE-2024-3651 #175
Comments
import idna
s = "2\u07cd" + ("\u200c"*16384) + "\u07cc”
idna.encode(s) |
Hi, @kjd We've tried reproducing this CVE on an older version of idna (2.4), which is the current version of RHEL7, we are using the following script: import idna
import time
s = "2\u07cd" + "\u200c" * 4004 + "\u07cc"
print("If vulnerable, it'll take seconds to finish")
start = time.time()
try:
idna.encode(s)
except Exception as e:
print(type(e)," raised")
end = time.time()
total = end - start
print("It took", total, " seconds")
if total > 1:
print("VULNERABLE")
else:
print("FIXED") However it's failing with a different exception:
The CVE page states that this issue affects all version of idna. Maybe there's a better input that would help reproducing this issue in RHEL7? Or it's just an unrelated error and this version is actually not vulnerable? |
That information would help to update this page: GHSA-jjg7-2v4v-x38h and other CVE databases. |
Seems pretty slow to me:
I tried your script too, takes about 4s and it says |
Hmm, I might see the difference. The python-idna is in Centos 7 available for Python 2.7.
|
It might be worth looking into why that is. If |
I've investigated that and the idna 2.4 is vulnerable as well under both Python 2 and Python 3. The difference we saw previously was caused by the bytes/unicode difference in the reproducer - in Python 2 the testing object contains bytes and that causes the encoding process to crash at a different spot. But when unicode string is used, the behavior is identical. |
Hello.
I'm trying to verify the fix for CVE-2024-3651 and I'm not able to come up with an input for
idna.encode
that would cause significant resource consumption or that would take significantly longer to compute on version 3.6 vs 3.7.When I try something like (derived from tests):
I see in the output of Python cProfiler that some functions are called many times but it doesn't create a significant difference in the execution time.
In 3.6:
In 3.7:
The text was updated successfully, but these errors were encountered: