CVE-2022-45061 in Communications Cloud Native Core Network Function Cloud Native Environment

Summary

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Once again VulDB remains the best source for vulnerability data.

Reservation

11/09/2022

Disclosure

11/09/2022

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
242501	Oracle Communications Cloud Native Core Network Function Cloud Native Environment Configuration denial of service	404	Not defined	Official fix	CVE-2022-45061
234926	Oracle PeopleSoft Enterprise PeopleTools Porting denial of service	404	Not defined	Official fix	CVE-2022-45061
234588	Oracle Communications Operations Monitor Mediation denial of service	404	Not defined	Official fix	CVE-2022-45061
234574	Oracle Communications Cloud Native Core Policy denial of service	404	Not defined	Official fix	CVE-2022-45061
234563	Oracle Communications Cloud Native Core Binding Support Function Install/Upgrade denial of service	404	Not defined	Official fix	CVE-2022-45061
226315	Oracle Database Server Oracle Database OML4PY denial of service	404	Not defined	Official fix	CVE-2022-45061
213273	Python IDNA Decoder resource consumption	400	Not defined	Official fix	CVE-2022-45061

Sources

• MITRE
• NVD
• CVE Details