Rencode Denial Of Service

`1) About Rencode  
Rencode is a "Python module for fast (basic) object serialization  
similar to bencode".  
https://github.com/aresch/rencode  
This library is used as a faster and more efficient data encoder than  
bencode.  
There are implementations in other languages: Golang, Javascript, Java,  
Ruby, dart, etc  
Some of these ports carry the same bug, the Go port does.  
(as an aside - not all of these derived works have preserved the  
original copyright and license)  
  
2) Vulnerability  
https://github.com/aresch/rencode/pull/29  
Given malformed input, the rencode parser enters an infinite loop.  
The shortest rencoded string to trigger this bug is ';\x2f\x7f' but  
there is an infinite number of possibilities.  
Although the library is accelerated in Cython, it cannot release the  
global interpreter lock so the Python interpreter process is irreparably  
locked up once the loop is entered.  
The software becomes unresponsive and consumes CPU until the process  
runs out of memory and is terminated - which can take a *very* long time.  
  
3) Affected software  
There are at least two active open-source network facing projects using  
the vulnerable python rencode library in their transport layer: xpra and  
deluge.  
Xpra is a remote desktop access tool - aka "screen for X11" and Deluge  
is a bittorrent client.  
There are other programs out there using this library but they are less  
prominent or not network facing, though there may well be more  
vulnerable software written in other languages.  
  
4) Example DoS against xpra  
Xpra uses rencode for structured messages between its processes,  
typically between clients and servers.  
Given an xpra process listening on a TCP port, sending this tiny (11  
bytes) malformed packet triggers the DoS:  
'P\x01\x00\x00\x00\x00\x00\x03;/\x7f'  
This does not require any authentication.  
Some packaged installations create a system wide proxy server which runs  
as root and listens on the IANA assigned TCP port 14500.  
Other socket types don't make it any harder to trigger (ie: websockets,  
SSL), only requiring extra packet encapsulation.  
Local users may also have access to other user's unix domain sockets.  
  
5) Mitigation  
The easiest way is to remove the Cython accelerated version of rencode:  
rm `python3 -c "from rencode import _rencode;print(_rencode.__file__)"`  
As the pure Python fallback implementation does not have this bug.  
  
6) Disclosure timeline  
2021-08-05 bug discovered, fix provided  
2021-08-06 requested a CVE from mitre  
2021-08-10 fix applied in rencode  
2021-09-07 disclosure  
  
  
  
`