CVE-2020-5236

Advisory

Pheonix-waitress 1.4.3 includes a fix for CVE-2020-5236: Catastrophic backtracking in regex allows Denial of Service.
https://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgc

Affected package

Affected versions

Fixed versions

Vulnerability changelog

------------------

Security Fixes
~~~~~~~~~~~~~~

- In Waitress version 1.4.2 a new regular expression was added to validate the
headers that Waitress receives to make sure that it matches RFC7230.
Unfortunately the regular expression was written in a way that with invalid
input it leads to catastrophic backtracking which allows for a Denial of
Service and CPU usage going to a 100%.

This was reported by Fil Zembowicz to the Pylons Project. Please see
https://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgc
for more information.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5236
• https://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgc
• https://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1f