Issue 41004: [CVE-2020-14422] Hash collisions in IPv4Interface and IPv6Interface

In the ipaddress library there exists two classes IPv4Interface, and IPv6Interface. These classes' hash functions will always return 32 and 64 respectively. If IPv4Interface or IPv6Interface objects then are put in a dictionary, on for example a server storing IPs, this will cause hash collisions, which in turn can lead to DOS.

The root of this is on line 1421 and 2095. On both lines, self._ip and self.network.network_address will both be same, and when xor is applied they will cancel eachother out, leaving return self._prefixlen .
Since self._prefixlen is a constant, 32 and 64 respectively, this will lead to a constant hash.

The fix is trivial, on line 1421, change to:
return hash((self._ip, self._prefixlen, int(self.network.network_address)))

and on line 2095, change to:
return hash((self._ip, self._prefixlen, int(self.network.network_address)))

Good catch. Your approach seems like a good one.

Forgot to add, this applies to all versions, 3.10, 3.9, 3.8, 3.7, 3.6, 3.5

Can I make a PR for this?

Absolutely, go ahead Amir

Changing versions to where the fix would be applied.

Hi
I have raised a PR for this. But my PLA is yet to be updated (I have singed it).

But add the fix to the existing versions (3.8, 3.9 and 3.10), do I need to raise PR for each of those branches?

No @rvteja92, you don't need open multiple PRs, only make your changes on master branch. for more informations read this:
https://devguide.python.org/

And for the CLA sign it will take a while to be updated.

Hi

My CLA has been approved. Can someone review the PR.

New changeset b30ee26e366bf509b7538d79bfec6c6d38d53f28 by Ravi Teja P in branch 'master':
bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033)
https://github.com/python/cpython/commit/b30ee26e366bf509b7538d79bfec6c6d38d53f28

New changeset dc8ce8ead182de46584cc1ed8a8c51d48240cbd5 by Miss Islington (bot) in branch '3.8':
bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033)
https://github.com/python/cpython/commit/dc8ce8ead182de46584cc1ed8a8c51d48240cbd5

New changeset 9a646aa82dfa62d70ca2a99ada901ee6cf9f82bd by Miss Islington (bot) in branch '3.9':
bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033)
https://github.com/python/cpython/commit/9a646aa82dfa62d70ca2a99ada901ee6cf9f82bd

Ned: what are your thoughts on backporting this as a security issue?

https://nvd.nist.gov/vuln/detail?vulnId=CVE-2020-14422

> https://nvd.nist.gov/vuln/detail?vulnId=CVE-2020-14422

As Eric said, this issue is assigned a CVE-2020-14422.
I re-open PRs for 3.5 - 3.7 and waiting for other core developers guide.

I am +1 on merge this PRs as the security patch.

A legitimate CVE should certainly be backported to all applicable releases, so, yes.  However, I think that it is important for the CVE to be mentioned in the NEWS blurbs for each commit.  So please update the NEWS items in each open PR to include the CVE. For master and 3.9 (if you hurry), you can update the original blurb file.  For 3.8, the blurb file is in the process of being merged into the blurb for the release; for it, wait until the v3.8.4rc1 has been merged back into the main cpython repo and then update the merged the blob, please.  Thanks!

New changeset b98e7790c77a4378ec4b1c71b84138cb930b69b7 by Tapas Kundu in branch '3.7':
[3.7] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) (GH-21231)
https://github.com/python/cpython/commit/b98e7790c77a4378ec4b1c71b84138cb930b69b7

New changeset cfc7ff8d05f7a949a88b8a8dd506fb5c1c30d3e9 by Tapas Kundu in branch '3.6':
[3.6] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) (GH-21232)
https://github.com/python/cpython/commit/cfc7ff8d05f7a949a88b8a8dd506fb5c1c30d3e9

New changeset 11d258ceafdf60ab3840f9a5700f2d0ad3e2e2d1 by Tapas Kundu in branch '3.5':
[3.5] bpo-41004: Resolve hash collisions for IPv4Interface and IPv6Interface (GH-21033) (#21233)
https://github.com/python/cpython/commit/11d258ceafdf60ab3840f9a5700f2d0ad3e2e2d1

pull_requests: + pull_request20385

pull_requests: + pull_request20137
stage: patch review