Python Deserialization Denial of Services Attacks and Their Mitigations

In recent years, many vulnerabilities in deserialization mechanisms are reported. Serialization is converting an object to a byte string, and deserialization is converting the byte string to the object. Pickle is a serialization/deserialization module in Python standard library. In the pickle module, specially-crafted data consumes huge memory in deserialization. There is a possibility that the memory consumption leads to deniable of services attacks. This paper precisely describes the DoS attacks and their mitigations.

Authors and Affiliations

1. Tokyo Denki University, Graduate School of Engineering, 5 Senju-Asahi-Cho, Tokyo, Adachi-Ku, 120-8551, Japan

   Kousei Tanaka & Taiichi Saito

Corresponding author

Correspondence to Kousei Tanaka .

Editors and Affiliations

1. Software Engineering and Information Technology Institute, Central Michigan University, Mount Pleasant, Michigan, USA

   Roger Lee

Appendix

1.1 Reply from Python Team

This subsection describes Python team’s reply to our report on the DoS attacks (Fig. 2).

Python team’s reply

Full size image

1.2 Changelog of Python Built-in Objects

This subsection describes the change history of Python built-in objects. Our DoS attacks were found in Python 3.5.2 and reported to Python team. However the changelog of the version 3.6.0 says as follows (Fig. 3).

Dict object

Full size image

This changelog is in python 3.6.0. An empty dictionary has reduced consumption memory with this change. However, an empty set consumes huge memory as in Python 3.5.2. The DoS attacks are still possible.

Reprints and permissions

© 2019 Springer International Publishing AG, part of Springer Nature

Policies and ethics