Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2020-10735

Published: 9 September 2022

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

From the Ubuntu Security Team

To avoid backwards-incompatible changes Ubuntu Security will not apply Python’s CVE-2020-10735 bugfix. Ubuntu Security does not consider int<->str conversion a security issue in Python. Rather, developers may introduce Denial of Service (DoS) vulnerabilities into their code by parsing unsanitized data with int<->str conversion. Developers using bignum integers are encouraged to consider specialized libraries, such as GMP. Using PyLong_FromString() in public APIs without an integer limit is strongly discouraged.

Notes

AuthorNote
alexmurray
The upstream patch for this issue now limits the input string for int() to 5000 digits - this is a breaking change but very unlikely to cause a regression since it is highly unlikely there is code handling such large numbers since as noted in the upstream commit, "total amount of protons in the observable universe is known as Eddington number. That number has 80 digits." - so 5000 digits out to be enough for anyone
eslerm
ongoing discourse on https://discuss.python.org
LWN reports patch causes regressions

Priority

Negligible

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package Release Status
python2.7
Launchpad, Ubuntu, Debian
jammy Ignored
(change too intrusive)
kinetic Ignored
(end of life, was ignored [change too intrusive])
bionic Ignored
(change too intrusive)
focal Ignored
(change too intrusive)
trusty Ignored
(change too intrusive)
upstream Needs triage

xenial Ignored
(change too intrusive)
python3.10
Launchpad, Ubuntu, Debian
kinetic Ignored
(end of life, was ignored [change too intrusive])
bionic Does not exist

focal Does not exist

jammy Ignored
(change too intrusive)
trusty Ignored
(end of standard support)
upstream Needs triage

xenial Ignored
(end of standard support)
python
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Ignored
(end of standard support)
python3.4
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

trusty Ignored
(change too intrusive)
upstream Needs triage

xenial Ignored
(end of standard support)
python3.5
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Does not exist

jammy Does not exist

trusty Ignored
(change too intrusive)
upstream Needs triage

xenial Ignored
(change too intrusive)
python3.6
Launchpad, Ubuntu, Debian
bionic Ignored
(change too intrusive)
focal Does not exist

jammy Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Ignored
(end of standard support)
python3.7
Launchpad, Ubuntu, Debian
bionic Ignored
(change too intrusive)
focal Does not exist

jammy Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Ignored
(end of standard support)
python3.8
Launchpad, Ubuntu, Debian
bionic Ignored
(change too intrusive)
focal Ignored
(change too intrusive)
jammy Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Ignored
(end of standard support)
python3.9
Launchpad, Ubuntu, Debian
bionic Does not exist

focal Ignored
(change too intrusive)
jammy Does not exist

trusty Ignored
(end of standard support)
upstream Needs triage

xenial Ignored
(end of standard support)

Severity score breakdown

Parameter Value
Base score 7.5
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H