This vulnerability has been modified and is currently undergoing reanalysis. Please check back soon to view the updated vulnerability summary.
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
NVD Analysts use publicly available information to associate vector strings and CVSS scores. We also display any CVSS information provided within the CVE List from the CNA.
Note: NVD Analysts have not published a CVSS score for this CVE at this time. NVD Analysts use publicly available information at the time of analysis to associate CVSS vector strings.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to email@example.com.
*cpe:2.3:a:python:python:*:*:*:*:*:*:*:* versions up to (including) 3.7.15
*cpe:2.3:a:python:python:*:*:*:*:*:*:*:* versions from (including) 3.8.0 up to (including) 3.8.15
*cpe:2.3:a:python:python:*:*:*:*:*:*:*:* versions from (including) 3.9.0 up to (including) 3.9.15
*cpe:2.3:a:python:python:*:*:*:*:*:*:*:* versions from (including) 3.10.0 up to (including) 3.10.8
https://github.com/python/cpython/issues/98433 No Types Assigned
https://github.com/python/cpython/issues/98433 Exploit, Patch, Third Party Advisory
CVE Dictionary Entry: CVE-2022-45061 NVD
Published Date: 11/09/2022 NVD
Last Modified: 01/13/2023