Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 2144072 (CVE-2022-45061) - CVE-2022-45061 python: CPU denial of service via inefficient IDNA decoder
Summary: CVE-2022-45061 python: CPU denial of service via inefficient IDNA decoder
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-45061
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2144426 2144416 2144417 2144418 2144419 2144420 2144421 2144422 2144423 2144424 2144425 2144428 2144429 2144430 2145064 2145065 2145066 2145067 2145068 2145069 2145070 2145071 2145072 2145073 2145074 2145075 2145076 2145077 2145078
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-11-18 21:19 UTC by Zack Miele
Modified: 2024-01-24 16:49 UTC (History)
5 users (show)

Fixed In Version: python 3.11.1, python 3.10.9, python 3.9.16, python 3.8.16, python 3.7.16
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was discovered in Python. A quadratic algorithm exists when processing inputs to the IDNA (RFC 3490) decoder, such that a crafted unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor, which could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied hostname.
Clone Of:
Environment:
Last Closed: 2023-05-16 16:54:59 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2023:6800 0 None None None 2023-11-08 09:36:08 UTC
Red Hat Product Errata RHSA-2023:0833 0 None None None 2023-02-21 09:21:41 UTC
Red Hat Product Errata RHSA-2023:0953 0 None None None 2023-02-28 08:18:52 UTC
Red Hat Product Errata RHSA-2023:2763 0 None None None 2023-05-16 08:10:00 UTC
Red Hat Product Errata RHSA-2023:2764 0 None None None 2023-05-16 08:10:05 UTC
Red Hat Product Errata RHSA-2023:2860 0 None None None 2023-05-16 08:21:04 UTC
Red Hat Product Errata RHSA-2023:6793 0 None None None 2023-11-08 08:17:11 UTC
Red Hat Product Errata RHSA-2024:0430 0 None None None 2024-01-24 16:49:36 UTC

Description Zack Miele 2022-11-18 21:19:15 UTC
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

https://github.com/python/cpython/issues/98433

Comment 1 Sandipan Roy 2022-11-21 08:49:09 UTC
Created mingw-python3 tracking bugs for this issue:

Affects: fedora-all [bug 2144417]


Created pypy tracking bugs for this issue:

Affects: epel-7 [bug 2144426]
Affects: fedora-all [bug 2144428]


Created pypy3.8 tracking bugs for this issue:

Affects: fedora-all [bug 2144429]


Created pypy3.9 tracking bugs for this issue:

Affects: fedora-all [bug 2144430]


Created python2.7 tracking bugs for this issue:

Affects: fedora-all [bug 2144418]


Created python3.10 tracking bugs for this issue:

Affects: fedora-all [bug 2144419]


Created python3.11 tracking bugs for this issue:

Affects: fedora-all [bug 2144420]


Created python3.12 tracking bugs for this issue:

Affects: fedora-all [bug 2144421]


Created python3.6 tracking bugs for this issue:

Affects: fedora-all [bug 2144422]


Created python3.7 tracking bugs for this issue:

Affects: fedora-all [bug 2144423]


Created python3.8 tracking bugs for this issue:

Affects: fedora-all [bug 2144424]


Created python3.9 tracking bugs for this issue:

Affects: fedora-all [bug 2144425]


Created python34 tracking bugs for this issue:

Affects: epel-all [bug 2144416]

Comment 5 errata-xmlrpc 2023-02-21 09:21:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:0833 https://access.redhat.com/errata/RHSA-2023:0833

Comment 7 errata-xmlrpc 2023-02-28 08:18:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:0953 https://access.redhat.com/errata/RHSA-2023:0953

Comment 8 errata-xmlrpc 2023-05-16 08:09:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2763 https://access.redhat.com/errata/RHSA-2023:2763

Comment 9 errata-xmlrpc 2023-05-16 08:10:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2764 https://access.redhat.com/errata/RHSA-2023:2764

Comment 10 errata-xmlrpc 2023-05-16 08:21:02 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2860 https://access.redhat.com/errata/RHSA-2023:2860

Comment 11 Product Security DevOps Team 2023-05-16 16:54:56 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-45061

Comment 12 errata-xmlrpc 2023-11-08 08:17:08 UTC
This issue has been addressed in the following products:

  Red Hat Software Collections for Red Hat Enterprise Linux 7

Via RHSA-2023:6793 https://access.redhat.com/errata/RHSA-2023:6793

Comment 14 errata-xmlrpc 2024-01-24 16:49:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0430 https://access.redhat.com/errata/RHSA-2024:0430


Note You need to log in before you can comment on or make changes to this bug.