René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"OOM vulnerability in the imaplib module","articleBody":"The IMAP4 protocol supports \"literal\" syntax, when one side specifies the size of the data and then sends the specified amount of bytes. The `imaplib` client reads such data with a single `read(size)` call, and therefore is affected by the general vulnerability in the `read()` method -- it allocates the amount of memory that came from untrusted source. Just an attempt to connect to the malicious IMAP4 server can send your Python program in swap.\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-119514\n* gh-129355\n* gh-129356\n* gh-129357\n* gh-129358\n* gh-130248\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/serhiy-storchaka","@type":"Person","name":"serhiy-storchaka"},"datePublished":"2024-05-24T17:52:54.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/119511/cpython/issues/119511"}