An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. https://github.com/python/cpython/issues/98433
Created mingw-python3 tracking bugs for this issue: Affects: fedora-all [bug 2144417] Created pypy tracking bugs for this issue: Affects: epel-7 [bug 2144426] Affects: fedora-all [bug 2144428] Created pypy3.8 tracking bugs for this issue: Affects: fedora-all [bug 2144429] Created pypy3.9 tracking bugs for this issue: Affects: fedora-all [bug 2144430] Created python2.7 tracking bugs for this issue: Affects: fedora-all [bug 2144418] Created python3.10 tracking bugs for this issue: Affects: fedora-all [bug 2144419] Created python3.11 tracking bugs for this issue: Affects: fedora-all [bug 2144420] Created python3.12 tracking bugs for this issue: Affects: fedora-all [bug 2144421] Created python3.6 tracking bugs for this issue: Affects: fedora-all [bug 2144422] Created python3.7 tracking bugs for this issue: Affects: fedora-all [bug 2144423] Created python3.8 tracking bugs for this issue: Affects: fedora-all [bug 2144424] Created python3.9 tracking bugs for this issue: Affects: fedora-all [bug 2144425] Created python34 tracking bugs for this issue: Affects: epel-all [bug 2144416]
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:0833 https://access.redhat.com/errata/RHSA-2023:0833
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:0953 https://access.redhat.com/errata/RHSA-2023:0953
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:2763 https://access.redhat.com/errata/RHSA-2023:2763
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:2764 https://access.redhat.com/errata/RHSA-2023:2764
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:2860 https://access.redhat.com/errata/RHSA-2023:2860
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-45061
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Via RHSA-2023:6793 https://access.redhat.com/errata/RHSA-2023:6793
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:0430 https://access.redhat.com/errata/RHSA-2024:0430