CVE-2022-45061

Published: 9 November 2022

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Priority

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package	Release	Status
python2.7 Launchpad, Ubuntu, Debian	kinetic	Ignored (end of life, was needs-triage)
	focal	Needs triage
	jammy	Needs triage
	upstream	Needs triage
	bionic	Released (2.7.17-1~18.04ubuntu1.10)
	trusty	Released (2.7.6-8ubuntu0.6+esm13) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	xenial	Released (2.7.12-1ubuntu0~16.04.18+esm3) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	lunar	Does not exist
python Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Ignored (end of standard support)
	upstream	Needs triage
	xenial	Ignored (end of standard support)
python3.4 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Needs triage
	upstream	Needs triage
	xenial	Does not exist
python3.5 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Needs triage
	upstream	Needs triage
	xenial	Released (3.5.2-2ubuntu0~16.04.13+esm6) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
python3.6 Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	bionic	Released (3.6.9-1~18.04ubuntu1.9)
python3.7 Launchpad, Ubuntu, Debian	bionic	Needs triage
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	Patches: upstream: https://github.com/python/cpython/commit/b0b590be9597fd5919228d251812dd54145f70a7
python3.8 Launchpad, Ubuntu, Debian	bionic	Needs triage
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	focal	Released (3.8.10-0ubuntu1~20.04.6)
python3.9 Launchpad, Ubuntu, Debian	bionic	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
	focal	Released (3.9.5-3ubuntu0~20.04.1+esm1) Available with Ubuntu Pro
python3.10 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Does not exist
	upstream	Needs triage
	jammy	Released (3.10.6-1~22.04.2)
	kinetic	Released (3.10.7-1ubuntu0.2)
	lunar	Does not exist
	Patches: upstream: https://github.com/python/cpython/commit/9bb8e18ca46fe66fa6802602f8a7228a24dd785f
python3.11 Launchpad, Ubuntu, Debian	trusty	Does not exist
	xenial	Does not exist
	bionic	Does not exist
	focal	Does not exist
	jammy	Needed
	kinetic	Ignored (end of life, was needed)
	upstream	Released (3.11.1)
	lunar	Not vulnerable (3.11.1-2)
	Patches: upstream: https://github.com/python/cpython/commit/a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15

Severity score breakdown

Parameter	Value
Base score	7.5
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Bugs

https://github.com/python/cpython/issues/98433

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›