CVE-2003-0973

Denial of service in mod_python (3.0.x < 3.0.4, 2.7.x < 2.7.9)

• CVSS 5.0
• CWE-400: Uncontrolled Resource Consumption
• Resource Management
• Remote

Unknown vulnerability in mod_python 3.0.x before 3.0.4, and 2.7.x before 2.7.9, allows remote attackers to cause a denial of service (httpd crash) via a certain query string.

CVE

CVE-2003-0973

CWE

CWE-400: Uncontrolled Resource Consumption

CVSS base score

5.0

Published

2003-12-15

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to mod_python version 3.0.4 or 2.7.9 or higher

from mod_python import apache

def handler(req):
    query_string = req.args

    if query_string:
        req.write("Query string received: {}".format(query_string))
    else:
        req.write("No query string provided.")

    return apache.OK

from mod_python import apache

def handler(req):
    try:
        query_string = req.args
        if not query_string:
            raise ValueError("Empty query string")

        max_length = 1024
        if len(query_string) > max_length:
            raise ValueError("Query string too long")

        req.write("Query string processed successfully.")
        
    except Exception as e:
        req.log_error("Error processing request: {}".format(e))
        req.status = apache.HTTP_BAD_REQUEST
        req.write("Bad Request: {}".format(e))
    
    return apache.OK

@misc{vaitp:cve20030973,
  title        = {{Denial of service in mod_python (3.0.x < 3.0.4, 2.7.x < 2.7.9)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2003},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2003-0973},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2003-0973/}}
}