CVE-2020-7212 @ Python-urllib3-1.25.7

[cx-tatianab]

Vulnerable Package issue exists @ Python-urllib3-1.25.7 in branch main

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.24 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).

Namespace: cx-tatianab
Repository: cxone-advanced-lab
Repository Url: https://github.com/cx-tatianab/cxone-advanced-lab
CxAST-Project: cx-tatianab/cxone-advanced-lab
CxAST platform scan: f48a8601-7787-4317-9a43-352045cff082
Branch: main
Application: cxone-advanced-lab
Severity: HIGH
State: NOT_IGNORED
Status: RECURRENT
CWE: CWE-400

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: NONE
Availability impact: HIGH
Remediation Upgrade Recommendation: 1.26.5

---

References
Release Note
Commit
Pull request
Advisory