PyPI: snudown
CVE-2021-41168
Safety vulnerability ID: SFTY-20211021-90796
Safety legacy ID: pyup.io-42206
Snudown 1.7.0 includes a fix for CVE-2021-41168: In affected versions snudown was found to be vulnerable to denial of service attacks to its reference table implementation. References written in markdown " [reference_name]: https://www.example.com" are inserted into a hash table which was found to have a weak hash function, meaning that an attacker can reliably generate a large number of collisions for it. This makes the hash table vulnerable to a hash-collision DoS attack, a type of algorithmic complexity attack. Further, the hash table allows for duplicate entries resulting in long retrieval times. Proofs of concept and further discussion of the hash collision issue are discussed on the snudown GHSA (https://github.com/reddit/snudown/security/advisories/GHSA-6gvv-9q92-w5f6). https://github.com/reddit/snudown/commit/1ac2c130b210539ee1e5d67a7bac93f9d8007c0e
Overview
Snudown 1.7.0 includes a fix for CVE-2021-41168: In affected versions snudown was found to be vulnerable to denial of service attacks to its reference table implementation. References written in markdown " [reference_name]: https://www.example.com" are inserted into a hash table which was found to have a weak hash function, meaning that an attacker can reliably generate a large number of collisions for it. This makes the hash table vulnerable to a hash-collision DoS attack, a type of algorithmic complexity attack. Further, the hash table allows for duplicate entries resulting in long retrieval times. Proofs of concept and further discussion of the hash collision issue are discussed on the snudown GHSA (https://github.com/reddit/snudown/security/advisories/GHSA-6gvv-9q92-w5f6). https://github.com/reddit/snudown/commit/1ac2c130b210539ee1e5d67a7bac93f9d8007c0e
Advisory
Snudown 1.7.0 includes a fix for CVE-2021-41168: In affected versions snudown was found to be vulnerable to denial of service attacks to its reference table implementation. References written in markdown " [reference_name]: https://www.example.com" are inserted into a hash table which was found to have a weak hash function, meaning that an attacker can reliably generate a large number of collisions for it. This makes the hash table vulnerable to a hash-collision DoS attack, a type of algorithmic complexity attack. Further, the hash table allows for duplicate entries resulting in long retrieval times. Proofs of concept and further discussion of the hash collision issue are discussed on the snudown GHSA (https://github.com/reddit/snudown/security/advisories/GHSA-6gvv-9q92-w5f6). https://github.com/reddit/snudown/commit/1ac2c130b210539ee1e5d67a7bac93f9d8007c0e
How to Fix
We recommend updating snudown to the latest non-vulnerable version.
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more