Homepage
About Snyk

colander@0.9.3 vulnerabilities

A simple schema-based serialization and deserialization library

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the colander package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Denial of Service (DoS)

colander is an An extensible package which can be used to: Deserialize and validate a data structure composed of strings, mappings, and lists. Serialize an arbitrary data structure to a data structure composed of strings, mappings, and lists.

Affected versions of this package are vulnerable to Denial of Service (DoS). The URL validator allows an attacker to potentially cause an infinite loop thereby causing a Denial of Service via an unclosed parenthesis.

PoC by Przemek:

from colander import MappingSchema, SchemaNode, Str, url


class MySchema(MappingSchema):
    url = SchemaNode(Str(encoding='utf-8'), validator=url)

print MySchema().deserialize({"url": "http://www.mysite.com/tttttttttttttttttttttt.jpg"})  # it works
print MySchema().deserialize({"url": "http://www.mysite.com/(tttttttttttttttttttttt).jpg"})  # it works
print MySchema().deserialize({"url": "http://www.mysite.com/(ttttttttttt.jpg"})  # it works
print MySchema().deserialize({"url": "http://www.mysite.com/(tttttttttttttttttttttt.jpg"})  # infinite loop

How to fix Denial of Service (DoS)?

Upgrade colander to version 1.7.0 or higher.

[,1.7.0)
Go back to all versions of this package