GHSA-rv95-4wxj-6fqq

Pylons Colander Denial of Service vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2017-18361

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	colander	< 1.7.0	1.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-18361 advisory
https://github.com/Pylons/colander/issues/290 web
https://github.com/Pylons/colander/pull/323 web
https://github.com/Pylons/colander/commit/98805557c10ab5ff3016ed09aa2d48c49b9df40b web
https://github.com/Pylons/colander package
https://github.com/advisories/GHSA-rv95-4wxj-6fqq advisory
https://github.com/pypa/advisory-database/tree/main/vulns/colander/PYSEC-2019-167.yaml web