Skip to content

[3.8] bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (GH-25916)#25933

Merged
ambv merged 1 commit intopython:3.8from
miss-islington:backport-47895e3-3.8
May 6, 2021
Merged

[3.8] bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 100 Continue (GH-25916)#25933
ambv merged 1 commit intopython:3.8from
miss-islington:backport-47895e3-3.8

Conversation

@miss-islington
Copy link
Copy Markdown
Contributor

@miss-islington miss-islington commented May 5, 2021 •
edited
Loading

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith greg@krypto.org
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu xgbarry@gmail.com

https://bugs.python.org/issue44022

Automerge-Triggered-By: GH:gpshead

@gen-xu @miss-islington
bpo-44022: Fix http client infinite line reading (DoS) after a HTTP 1…
e73c448 
…00 Continue (pythonGH-25916)

Fixes http.client potential denial of service where it could get stuck reading lines from a malicious server after a 100 Continue response.

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 47895e3)

Co-authored-by: Gen Xu <xgbarry@gmail.com>
@miss-islington
Copy link
Copy Markdown
Contributor Author

miss-islington commented May 5, 2021

@gen-xu and @gpshead: Status check is done, and it's a success ✅ .

@bedevere-bot bedevere-bot mentioned this pull request May 5, 2021
Merged
@miss-islington
Copy link
Copy Markdown
Contributor Author

miss-islington commented May 5, 2021

@gen-xu and @gpshead: Status check is done, and it's a success ✅ .

@bedevere-bot bedevere-bot added the type-bug An unexpected behavior, bug, or error label May 5, 2021
@miss-islington
Copy link
Copy Markdown
Contributor Author

miss-islington commented May 5, 2021

@gen-xu and @gpshead: Status check is done, and it's a success ✅ .

@miss-islington
Copy link
Copy Markdown
Contributor Author

miss-islington commented May 5, 2021

Sorry, I can't merge this PR. Reason: You're not authorized to push to this branch. Visit https://docs.github.com/articles/about-protected-branches/ for more information..

@ambv ambv merged commit f396864 into python:3.8 May 6, 2021
@bedevere-bot
Copy link
Copy Markdown

bedevere-bot commented May 6, 2021

@ambv: Please replace # with GH- in the commit message next time. Thanks!

@miss-islington miss-islington deleted the backport-47895e3-3.8 branch May 6, 2021 08:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

Assignees

@ambv ambv

Labels

type-bug An unexpected behavior, bug, or error type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@miss-islington @bedevere-bot @gpshead @ambv @the-knights-who-say-ni @gen-xu