1-day

こんにちは、ユンソクチャンと申します。最近、私がPythonチームに報告した脆弱性が公開されました。 この脆弱性は、CVSS 3.xの基準で10点中7.5点で、「高い」深刻度と評価されました。この問題を悪用すると、インターネット上のすべてのDjangoサーバーでDoS（サービス拒否）攻撃を引き起こす可能性がありました。 Pythonの正規表現とReDoS脆弱性 正規表現はテキスト処理でよく使われる強力なツールです。しかし、正規表現が複雑になると、解析や一致を見つける計算量が急激に増加することがあります。Pythonのreモジュールはバックトラッキングを使う方法で正規表現を処理します。この方法では、特定の入力で計算時間が指数関数的に増えることがあります。 import re # the example of complex regex string complex_regex = re.compile("(a+)+$") def check_complex_string(s): return complex_regex.match(s) payload = "aaa

Hi, I'm Seokchan Yoon. Recently, a vulnerability I reported to the Python Project was made public. The vulnerability, known as CVE-2024-7592, has a severity score of 7.5 out of 10 according to CVSS 3.x, which is considered 'High'. If it's exploited, it could cause a Denial of Service

안녕하세요. 윤석찬입니다. 최근 제가 Python의 CPython 라이브러리에 제보한 취약점이 공개되었습니다. CVSS 3.x 기준 Serverity는 10점 만점 중 7.5점으로 심각도는 '높음'으로 평가되었고, 해당 취약점을 악용하면 인터넷에 노출된 모든 Django 서버에 DoS를 유발시킬 수 있었습니다. 본 글에서는 파이썬의 표준 라이브러리 중 하나인 http.cookies 모듈의 _unquote() 메소드에서 발견된 서비스 거부(

CVE-2024-24680: Potential denial-of-service in intcomma template filter TL;DR The intcomma template filter was subject to a potential denial-of-service attack when used with very long strings. Your Django server can be under affected denial-of-service issue if you have the code like below, that intcomma template filter uses the value user

Hi! This is Seokchan Yoon studying Offensive Security in Korea. 🇰🇷 __ 1. Introduction On July 3rd, 2023, my first CVE was published! * https://www.djangoproject.com/weblog/2023/jul/03/security-releases/ * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36053 You can briefly check the details of the vulnerability that I