Denial of Service in geopy via Malformed Coordinate Strings

Executive Summary

This is a Regular Expression Denial of Service (ReDoS) vulnerability in the geopy library affecting versions up to 2.4.1. It occurs in the geopy.Point class and Point.from_string() method when parsing long, malformed coordinate strings. The issue is caused by inefficient regular expression handling that leads to excessive CPU time consumption due to catastrophic backtracking.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor CPU usage spikes when processing coordinate strings. Check if geopy.Point or Point.from_string() is called with long malformed inputs. Use logging to track requests exceeding 256 characters in coordinate strings.

Useful 0 Not Useful 0

Impact Analysis

An attacker could send repeated requests with long malformed coordinate strings to cause high CPU usage, leading to service disruption or denial of service. Applications using geopy.Point() or geocoder reverse methods with user-supplied location data are at risk. The numeric Point constructor is unaffected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial of service through excessive CPU usage during regex processing of malformed inputs. While it does not directly violate GDPR or HIPAA, it could indirectly impact compliance by disrupting services that handle personal data. For example, a DoS condition might prevent timely access to health records (HIPAA) or user data (GDPR), potentially leading to violations if service levels are not maintained.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade geopy to version 2.5.0 or later to apply the fix.
• Implement input validation to limit coordinate strings to 256 characters before processing.
• Monitor network traffic for repeated requests with long malformed coordinate strings.

Useful 0 Not Useful 0