—

PYSEC-2019-167

Quick fix

PYSEC-2019-167 — colander: upgrade to the fixed version with the command below.

pip install --upgrade 'colander>=1.7.0'

Details

In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/colander

Introduced in: 0Fixed in: 1.7.0

Fixpip install --upgrade 'colander>=1.7.0'

References

https://github.com/Pylons/colander/pull/323[WEB]
https://github.com/Pylons/colander/issues/290[REPORT]
https://github.com/advisories/GHSA-rv95-4wxj-6fqq[ADVISORY]