Bug 2144072 (CVE-2022-45061)
| Summary: | CVE-2022-45061 python: CPU denial of service via inefficient IDNA decoder | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Zack Miele <zmiele> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | cstratak, hartsjc, hhorak, jorton, python-maint |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | python 3.11.1, python 3.10.9, python 3.9.16, python 3.8.16, python 3.7.16 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A vulnerability was discovered in Python. A quadratic algorithm exists when processing inputs to the IDNA (RFC 3490) decoder, such that a crafted unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor, which could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied hostname.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-05-16 16:54:59 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2144426, 2144416, 2144417, 2144418, 2144419, 2144420, 2144421, 2144422, 2144423, 2144424, 2144425, 2144428, 2144429, 2144430, 2145064, 2145065, 2145066, 2145067, 2145068, 2145069, 2145070, 2145071, 2145072, 2145073, 2145074, 2145075, 2145076, 2145077, 2145078 | ||
| Bug Blocks: | 2143956 | ||
|
Description
Zack Miele
2022-11-18 21:19:15 UTC
Created mingw-python3 tracking bugs for this issue: Affects: fedora-all [bug 2144417] Created pypy tracking bugs for this issue: Affects: epel-7 [bug 2144426] Affects: fedora-all [bug 2144428] Created pypy3.8 tracking bugs for this issue: Affects: fedora-all [bug 2144429] Created pypy3.9 tracking bugs for this issue: Affects: fedora-all [bug 2144430] Created python2.7 tracking bugs for this issue: Affects: fedora-all [bug 2144418] Created python3.10 tracking bugs for this issue: Affects: fedora-all [bug 2144419] Created python3.11 tracking bugs for this issue: Affects: fedora-all [bug 2144420] Created python3.12 tracking bugs for this issue: Affects: fedora-all [bug 2144421] Created python3.6 tracking bugs for this issue: Affects: fedora-all [bug 2144422] Created python3.7 tracking bugs for this issue: Affects: fedora-all [bug 2144423] Created python3.8 tracking bugs for this issue: Affects: fedora-all [bug 2144424] Created python3.9 tracking bugs for this issue: Affects: fedora-all [bug 2144425] Created python34 tracking bugs for this issue: Affects: epel-all [bug 2144416] This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:0833 https://access.redhat.com/errata/RHSA-2023:0833 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:0953 https://access.redhat.com/errata/RHSA-2023:0953 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:2763 https://access.redhat.com/errata/RHSA-2023:2763 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:2764 https://access.redhat.com/errata/RHSA-2023:2764 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:2860 https://access.redhat.com/errata/RHSA-2023:2860 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-45061 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2023:6793 https://access.redhat.com/errata/RHSA-2023:6793 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:0430 https://access.redhat.com/errata/RHSA-2024:0430 |