PT-2019-8300 · Pylons · Pylons Colander

Digitalresistor · Published 2019-02-01 · Updated 2024-07-12 · CVE-2017-18361

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pylons Colander versions prior to 1.7

Description The issue allows an attacker to potentially cause a denial of service via an unclosed parenthesis in the URL validator, which can lead to an infinite loop.

Recommendations For versions prior to 1.7, update to version 1.7 or later to resolve the issue.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2017-18361

GHSA-RV95-4WXJ-6FQQ

OPENSUSE-SU-2024:11222-1

OPENSUSE-SU-2024:14136-1

PYSEC-2019-167

Affected Products

Pylons Colander

References · 15

• 🔥 https://github.com/Pylons/colander/issues/290 · Exploit
• https://github.com/Pylons/colander/pull/323 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:14136-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18361 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18361 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-18361 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18361 · Security Note
• https://osv.dev/vulnerability/GHSA-rv95-4wxj-6fqq · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-18361 · Security Note
• https://osv.dev/vulnerability/PYSEC-2019-167 · Vendor Advisory
• https://github.com/Pylons/colander/commit/98805557c10ab5ff3016ed09aa2d48c49b9df40b · Note
• https://github.com/Pylons/colander · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/colander/PYSEC-2019-167.yaml · Note
• https://github.com/advisories/GHSA-rv95-4wxj-6fqq · Note
• https://suse.com/security/cve/CVE-2017-18361 · Note