Skip to content

v3.3.2a0 (without niquests)

Pre-release
Pre-release

Choose a tag to compare

View all tags
@tobixen tobixen released this 15 Oct 12:53
· 148 commits to master since this release
v3.3.2a0
This tag was signed with the committer’s verified signature.
tobixen Tobias Brox
GPG key ID: A8591F23C40DEF4E
Verified
Learn about vigilant mode.
2f74ba1

caldav v3.3.2a0 - v3.3.2 without the niquests dependency

Security release: 3.3.1 with only the fix below. Also released without the niquests dependency as 3.3.2a0.

Security

  • A small DoS-risk found. An attacker controlling the icalendar data flowing through the library can aggressively burn CPU-cycles. vcal.fix(), run on every iCalendar object fetched from a server, took quadratic time on a long run of blanks or backslashes - 100 kB took more than 20 s, so a hostile server or a shared calendar could stall the client. The regexp has been fixed up and now takes linear time to run; the output is unchanged. Reported by @BrianWillows. GHSA-5h4q-xm57-3mh5 Also fixed in 3.5.0 and 3.4.1.

Contributors

BrianWillows
Assets 2
Loading