CVE-2022-40899 Python Charmers Future denial of service vulnerability
Remote attackers can cause denial of service in applications using the Python Future library by sending crafted Set-Cookie headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-40899?
CVE-2022-40899 is a high-severity denial of service vulnerability in n/a, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malicious web server.
Weakness: CWE-400
Which versions are affected by CVE-2022-40899?
3 open source packages ship an affected version, including future. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
future PyPI | All versions | 0.18.3 |
future PyPI | All versions | 0.18.3 |
future PyPI | All versions | 0.18.3 |
Linux distribution packages (19)
python-future SUSE:Linux Enterprise Micro 5.1 | All versions | 0.18.2-150300.3.3.1 |
python-future SUSE:Linux Enterprise Micro 5.2 | All versions | 0.18.2-150300.3.3.1 |
python-future SUSE:Linux Enterprise Micro 5.3 | All versions | 0.18.2-150300.3.3.1 |
python-future SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 0.18.2-150300.3.3.1 |
python-future SUSE:Linux Enterprise Module for Public Cloud 12 | All versions | 0.15.2-3.3.1 |
python3 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 3.4.10-25.105.1 |
python3-base SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 3.4.10-25.105.1 |
python-future SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 0.18.2-150300.3.3.1 |
python-future SUSE:Linux Enterprise Server 12 SP5 | All versions | 0.15.2-3.5.1 |
python3 SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.4.10-25.105.1 |
python3-base SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.4.10-25.105.1 |
python-future SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 0.15.2-3.5.1 |
python3 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.4.10-25.105.1 |
python3-base SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.4.10-25.105.1 |
python3 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.4.10-25.105.1 |
python3-base SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.4.10-25.105.1 |
python-future openSUSE:Leap 15.4 | All versions | 0.18.2-150300.3.3.1 |
python-future openSUSE:Leap Micro 5.2 | All versions | 0.18.2-150300.3.3.1 |
python-future openSUSE:Leap Micro 5.3 | All versions | 0.18.2-150300.3.3.1 |
Products include Pythoncharmers Python-Future.
How do I fix CVE-2022-40899?
Upgrade future to 0.18.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-40899 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-40899 exists.
Sources
Also known as DEBIAN-CVE-2022-40899, GHSA-v3c5-jqr6-7qm8, MGASA-2023-0030, OESA-2023-1176, PYSEC-2022-42991, ROOT-APP-PYPI-CVE-2022-40899 and 7 more.