CVE-2020-7212 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-7212 Interim 1 51 2025-02-17T01:37:14Z current 2021-05-30T14:37:31Z 2025-02-17T01:37:14Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-7212 The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings HPE Helion OpenStack 8 HPE Helion OpenStack Cloud 8 SUSE CaaS Platform 3.0 SUSE Container as a Service Platform 2.0 SUSE Enterprise Storage 5 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Python 2 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Python 2 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Python 2 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Python 2 15 SP3 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Python 2 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Python 2 15 SP3 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Python 2 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Python 2 15 SP3 SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Python 2 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Python 2 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Python 2 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Python 2 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Python 2 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Python 2 15 SP3 SUSE Manager Server 3.2 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Python 2 15 SP1 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Python 2 15 SP3 SUSE OpenStack Cloud 6-LTSS SUSE OpenStack Cloud 7 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 python-urllib3 python2-urllib3 python3-urllib3 python-urllib3 as a component of HPE Helion OpenStack 8 python3-urllib3 as a component of HPE Helion OpenStack 8 python-urllib3 as a component of HPE Helion OpenStack Cloud 8 python-urllib3 as a component of SUSE CaaS Platform 3.0 python-urllib3 as a component of SUSE Container as a Service Platform 2.0 python-urllib3 as a component of SUSE Enterprise Storage 5 python2-urllib3 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS python3-urllib3 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS python-urllib3 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS python3-urllib3 as a component of SUSE Linux Enterprise Micro 5.1 python-urllib3 as a component of SUSE Linux Enterprise Micro 5.1 python2-urllib3 as a component of SUSE Linux Enterprise Module for Basesystem 15 python3-urllib3 as a component of SUSE Linux Enterprise Module for Basesystem 15 python-urllib3 as a component of SUSE Linux Enterprise Module for Basesystem 15 python3-urllib3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 python-urllib3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 python3-urllib3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python-urllib3 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python-urllib3 as a component of SUSE Linux Enterprise Module for Public Cloud 12 python3-urllib3 as a component of SUSE Linux Enterprise Module for Public Cloud 12 python2-urllib3 as a component of SUSE Linux Enterprise Module for Python 2 15 SP1 python-urllib3 as a component of SUSE Linux Enterprise Module for Python 2 15 SP1 python2-urllib3 as a component of SUSE Linux Enterprise Module for Python 2 15 SP3 python-urllib3 as a component of SUSE Linux Enterprise Module for Python 2 15 SP3 python3-urllib3 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS python-urllib3 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS python-urllib3 as a component of SUSE Linux Enterprise Server Teradata 12 SP3 python-urllib3 as a component of SUSE Manager Server 3.2 python3-urllib3 as a component of SUSE Manager Server 3.2 python-urllib3 as a component of SUSE OpenStack Cloud 6-LTSS python-urllib3 as a component of SUSE OpenStack Cloud 7 python3-urllib3 as a component of SUSE OpenStack Cloud 7 python-urllib3 as a component of SUSE OpenStack Cloud 8 python3-urllib3 as a component of SUSE OpenStack Cloud 8 python-urllib3 as a component of SUSE OpenStack Cloud 9 python3-urllib3 as a component of SUSE OpenStack Cloud 9 python-urllib3 as a component of SUSE OpenStack Cloud Crowbar 8 python3-urllib3 as a component of SUSE OpenStack Cloud Crowbar 8 python-urllib3 as a component of SUSE OpenStack Cloud Crowbar 9 python3-urllib3 as a component of SUSE OpenStack Cloud Crowbar 9 The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2). CVE-2020-7212 HPE Helion OpenStack 8:python-urllib3 HPE Helion OpenStack 8:python3-urllib3 HPE Helion OpenStack Cloud 8:python-urllib3 SUSE CaaS Platform 3.0:python-urllib3 SUSE Container as a Service Platform 2.0:python-urllib3 SUSE Enterprise Storage 5:python-urllib3 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:python-urllib3 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:python2-urllib3 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:python3-urllib3 SUSE Linux Enterprise Micro 5.1:python-urllib3 SUSE Linux Enterprise Micro 5.1:python3-urllib3 SUSE Linux Enterprise Module for Basesystem 15 SP1:python-urllib3 SUSE Linux Enterprise Module for Basesystem 15 SP1:python3-urllib3 SUSE Linux Enterprise Module for Basesystem 15 SP3:python-urllib3 SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-urllib3 SUSE Linux Enterprise Module for Basesystem 15:python-urllib3 SUSE Linux Enterprise Module for Basesystem 15:python2-urllib3 SUSE Linux Enterprise Module for Basesystem 15:python3-urllib3 SUSE Linux Enterprise Module for Public Cloud 12:python-urllib3 SUSE Linux Enterprise Module for Public Cloud 12:python3-urllib3 SUSE Linux Enterprise Module for Python 2 15 SP1:python-urllib3 SUSE Linux Enterprise Module for Python 2 15 SP1:python2-urllib3 SUSE Linux Enterprise Module for Python 2 15 SP3:python-urllib3 SUSE Linux Enterprise Module for Python 2 15 SP3:python2-urllib3 SUSE Linux Enterprise Server 12 SP4-LTSS:python-urllib3 SUSE Linux Enterprise Server 12 SP4-LTSS:python3-urllib3 SUSE Linux Enterprise Server Teradata 12 SP3:python-urllib3 SUSE Manager Server 3.2:python-urllib3 SUSE Manager Server 3.2:python3-urllib3 SUSE OpenStack Cloud 6-LTSS:python-urllib3 SUSE OpenStack Cloud 7:python-urllib3 SUSE OpenStack Cloud 7:python3-urllib3 SUSE OpenStack Cloud 8:python-urllib3 SUSE OpenStack Cloud 8:python3-urllib3 SUSE OpenStack Cloud 9:python-urllib3 SUSE OpenStack Cloud 9:python3-urllib3 SUSE OpenStack Cloud Crowbar 8:python-urllib3 SUSE OpenStack Cloud Crowbar 8:python3-urllib3 SUSE OpenStack Cloud Crowbar 9:python-urllib3 SUSE OpenStack Cloud Crowbar 9:python3-urllib3 important 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H