GHSA-5qcg-w2cc-xffw

Uncontrolled resource consumption in validators Python package

Source: GitHub Advisory Database (reviewed) High CVE-2019-19588

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	validators	>= 0.12.2, < 0.12.6	0.12.6

Details

As written in the advisory (Markdown source, shown as plain text).

The validators package 0.12.2 through 0.12.5 for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed in 0.12.6.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-19588 advisory
https://github.com/kvesteri/validators/issues/86 web
https://github.com/python-validators/validators/issues/86 web
https://github.com/advisories/GHSA-5qcg-w2cc-xffw advisory
https://github.com/pypa/advisory-database/tree/main/vulns/validators/PYSEC-2019-134.yaml web
https://github.com/python-validators/validators package