CVE-2022-45061

NameCVE-2022-45061
DescriptionAn issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3432-1, DLA-3477-1, ELA-853-1, ELA-884-1, ELA-885-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python2.7 (PTS)jessie, jessie (lts)2.7.9-2-ds1-1+deb8u11fixed
stretch (security)2.7.13-2+deb9u6vulnerable
stretch (lts), stretch2.7.13-2+deb9u8fixed
buster2.7.16-2+deb10u1vulnerable
buster (security)2.7.16-2+deb10u3fixed
bullseye2.7.18-8+deb11u1vulnerable
python3.10 (PTS)sid3.10.13-1fixed
python3.11 (PTS)bookworm3.11.2-6fixed
trixie3.11.8-1fixed
sid3.11.8-2fixed
python3.4 (PTS)jessie, jessie (lts)3.4.2-1+deb8u15fixed
python3.5 (PTS)stretch (security)3.5.3-1+deb9u5vulnerable
stretch (lts), stretch3.5.3-1+deb9u8fixed
python3.7 (PTS)buster3.7.3-2+deb10u3vulnerable
buster (security)3.7.3-2+deb10u6fixed
python3.9 (PTS)bullseye3.9.2-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python2.7sourcejessie2.7.9-2-ds1-1+deb8u10ELA-853-1
python2.7sourcestretch2.7.13-2+deb9u7ELA-853-1
python2.7sourcebuster2.7.16-2+deb10u2DLA-3432-1
python2.7source(unstable)(unfixed)
python3.10source(unstable)3.10.9-1
python3.11source(unstable)3.11.1-1
python3.4sourcejessie3.4.2-1+deb8u15ELA-885-1
python3.4source(unstable)(unfixed)
python3.5sourcestretch3.5.3-1+deb9u7ELA-884-1
python3.5source(unstable)(unfixed)
python3.7sourcebuster3.7.3-2+deb10u5DLA-3477-1
python3.7source(unstable)(unfixed)
python3.9source(unstable)(unfixed)

Notes

[bullseye] - python3.9 <no-dsa> (Minor issue)
[bullseye] - python2.7 <ignored> (Unsupported in Bullseye, only included to build a few applications)
https://github.com/python/cpython/issues/98433
https://github.com/python/cpython/pull/99092
https://github.com/python/cpython/commit/a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15 (v3.11.1)
https://github.com/python/cpython/commit/9bb8e18ca46fe66fa6802602f8a7228a24dd785f (v3.10.9)
https://github.com/python/cpython/commit/c09dba57cfbbf74273ce44b1f48f71b46806605c (v3.9.16)
https://github.com/python/cpython/commit/82ca2839c9ec6bf9a9400e791a52411824df67f3 (v3.8.16)
https://github.com/python/cpython/commit/b0b590be9597fd5919228d251812dd54145f70a7 (v3.7.16)

Search for package or bug name: Reporting problems