CVE-2013-1752

Python readline calls allow remote DoS via long strings in various libraries.

• CVSS 6.0
• CWE-400
• Resource Management
• Remote

Rejected reason: Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service (memory consumption) via a long string, related to (1) httplib – fixed in 2.7.4, 2.6.9, and 3.3.3; (2) ftplib – fixed in 2.7.6, 2.6.9, 3.3.3; (3) imaplib – not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; (4) nntplib – fixed in 2.7.6, 2.6.9, 3.3.3; (5) poplib – not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; and (6) smtplib – not yet fixed in 2.7.x, fixed in 2.6.9, not yet fixed in 3.3.x. NOTE: this was REJECTed because it is incompatible with CNT1 "Independently Fixable" in the CVE Counting Decisions

CVE

CVE-2013-1752

CWE

CWE-400

CVSS base score

6.0

Published

2019-06-03

OWASP

A09 Security Logging and Monitoring Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

Python

Fixed by upgrading

Yes

Solution

Upgrade to Python versions 2.7.6, 2.6.9, or 3.3.3 where applicable.

import socket

def readline(sock):
    return sock.recv(4096).decode('utf-8')

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.connect(('example.com', 80))
    s.sendall(b'GET / HTTP/1.1\r\nHost: example.com\r\n\r\n')
    response = readline(s)
    print(response)

import socket

def readline(sock):
    max_length = 1024
    data = sock.recv(max_length)
    if len(data) >= max_length:
        raise ValueError("Input too long")
    return data.decode('utf-8')

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.connect(('example.com', 80))
    s.sendall(b'GET / HTTP/1.1\r\nHost: example.com\r\n\r\n')
    response = readline(s)
    print(response)

payload = "A" * 10**6  # A long string of 1,000,000 characters to cause memory exhaustion

@misc{vaitp:cve20131752,
  title        = {{Python readline calls allow remote DoS via long strings in various libraries.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2013-1752},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2013-1752/}}
}