CVE-2022-45061

NameCVE-2022-45061
DescriptionAn issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3432-1, DLA-3477-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python2.7 (PTS)buster2.7.16-2+deb10u1vulnerable
buster (security)2.7.16-2+deb10u4fixed
bullseye2.7.18-8+deb11u1vulnerable
python3.10 (PTS)sid3.10.13-1fixed
python3.11 (PTS)bookworm3.11.2-6fixed
trixie3.11.8-1fixed
sid3.11.8-3fixed
python3.7 (PTS)buster3.7.3-2+deb10u3vulnerable
buster (security)3.7.3-2+deb10u7fixed
python3.9 (PTS)bullseye3.9.2-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python2.7sourcebuster2.7.16-2+deb10u2DLA-3432-1
python2.7source(unstable)(unfixed)
python3.10source(unstable)3.10.9-1
python3.11source(unstable)3.11.1-1
python3.7sourcebuster3.7.3-2+deb10u5DLA-3477-1
python3.7source(unstable)(unfixed)
python3.9source(unstable)(unfixed)

Notes

[bullseye] - python3.9 <no-dsa> (Minor issue)
[bullseye] - python2.7 <ignored> (Unsupported in Bullseye, only included to build a few applications)
https://github.com/python/cpython/issues/98433
https://github.com/python/cpython/pull/99092
https://github.com/python/cpython/commit/a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15 (v3.11.1)
https://github.com/python/cpython/commit/9bb8e18ca46fe66fa6802602f8a7228a24dd785f (v3.10.9)
https://github.com/python/cpython/commit/c09dba57cfbbf74273ce44b1f48f71b46806605c (v3.9.16)
https://github.com/python/cpython/commit/82ca2839c9ec6bf9a9400e791a52411824df67f3 (v3.8.16)
https://github.com/python/cpython/commit/b0b590be9597fd5919228d251812dd54145f70a7 (v3.7.16)

Search for package or bug name: Reporting problems