[issue17980] CVE-2013-2099 ssl.match_hostname() trips over crafted wildcard names

[Florian Weimer]

Florian Weimer added the comment:

> "*" pattern is replace with '[^.]+' regex, so I may not cause the exponential complexity issue. (I didn't check.)

A possessive quantifier might also help, that is [^.]+?.

----------

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue17980>
_______________________________________