diff --git a/CHANGES b/CHANGES
index 92d9d414..c358fa9e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -14,6 +14,11 @@ The following undocumented functions are deprecated and scheduled for removal:
- ``ldap.cidict.strlist_minus``
- ``ldap.cidict.strlist_union``
+Security fixes:
+* Fix inefficient regular expression which allows denial-of-service attacks
+ when parsing specially-crafted LDAP schema.
+ (GHSL-2021-117)
+
Changes:
* On MacOS, remove option to make LDAP connections from a file descriptor
when built with the system libldap (which lacks the underlying function,
diff --git a/Lib/ldap/schema/tokenizer.py b/Lib/ldap/schema/tokenizer.py
index 69823f2b..623b86d5 100644
--- a/Lib/ldap/schema/tokenizer.py
+++ b/Lib/ldap/schema/tokenizer.py
@@ -13,7 +13,7 @@
r"|" # or
r"([^'$()\s]+)" # string of length >= 1 without '$() or whitespace
r"|" # or
- r"('(?:[^'\\]|\\\\|\\.)*?'(?!\w))"
+ r"('(?:[^'\\]|\\.)*'(?!\w))"
# any string or empty string surrounded by unescaped
# single quotes except if right quote is succeeded by
# alphanumeric char
pFad - Phonifier reborn
Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.
Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.
Alternative Proxies:
Alternative Proxy
pFad Proxy
pFad v3 Proxy
pFad v4 Proxy