PYSEC-2021-345

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/rencode/PYSEC-2021-345.yaml

Aliases

• CVE-2021-40839
• GHSA-gh8j-2pgf-x458

Published

2021-09-10T02:15:00Z

Modified

2023-11-08T04:06:49.627763Z

Details

The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.

References

• https://github.com/aresch/rencode/pull/29
• https://pypi.org/project/rencode/#history
• https://seclists.org/fulldisclosure/2021/Sep/16
• https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75
• https://github.com/advisories/GHSA-gh8j-2pgf-x458