CVE-2022-40899

Advisory

Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.
https://github.com/PythonCharmers/python-future/blob/master/src/future/backports/http/cookiejar.py#L215
https://github.com/python/cpython/pull/17157

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40899
• https://pypi.org/project/future/
• https://github.com/python/cpython/pull/17157
• https://github.com/PythonCharmers/python-future/blob/master/src/future/backports/http/cookiejar.py#L215
• https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages/
• https://github.com/PythonCharmers/python-future/pull/610