—

PYSEC-2021-345

Quick fix

PYSEC-2021-345 — rencode: upgrade to the fixed version with the command below.

pip install --upgrade 'rencode>=572ff74586d9b1daab904c6f7f7009ce0143bb75'

Details

The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/rencode

Introduced in: 0Fixed in: 572ff74586d9b1daab904c6f7f7009ce0143bb75

Fixpip install --upgrade 'rencode>=572ff74586d9b1daab904c6f7f7009ce0143bb75'

References

https://github.com/aresch/rencode/pull/29[WEB]
https://pypi.org/project/rencode/#history[PACKAGE]
https://seclists.org/fulldisclosure/2021/Sep/16[WEB]
https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75[FIX]
https://github.com/advisories/GHSA-gh8j-2pgf-x458[ADVISORY]