CVE-2022-40899

Python Charmers Future 0.18.2 and earlier: DoS via malicious Set-Cookie header

• CVSS 7.5
• CWE-400
• Input Validation and Sanitization
• Remote

An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.

CVE

CVE-2022-40899

CWE

CWE-400

CVSS base score

7.5

Published

2022-12-23

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update Python Charmers Future to version 0.18.3 or higher.

import http.cookies

def set_cookie(header_value):
    cookie = http.cookies.SimpleCookie()
    cookie.load(header_value)
    return cookie.output(header='', sep='').strip()

header_value = "sessionid=abc123; HttpOnly; Secure"
cookie = set_cookie(header_value)
print("Set-Cookie header:", cookie)

import http.cookies

def set_cookie(header_value):
    try:
        cookie = http.cookies.SimpleCookie()
        cookie.load(header_value)
        return cookie.output(header='', sep='').strip()
    except Exception as e:
        print("Invalid Set-Cookie header:", e)
        return None

header_value = "sessionid=abc123; HttpOnly; Secure"
cookie = set_cookie(header_value)
if cookie:
    print("Set-Cookie header:", cookie)

@misc{vaitp:cve202240899,
  title        = {{Python Charmers Future 0.18.2 and earlier: DoS via malicious Set-Cookie header}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-40899},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-40899/}}
}