Python up to 3.7.15/3.8.15/3.9.15/3.10.8/3.11.0 IDNA Decoder resource consumption

Summaryinfo

A vulnerability marked as problematic has been reported in Python up to 3.7.15/3.8.15/3.9.15/3.10.8/3.11.0. Impacted is an unknown function of the component IDNA Decoder. Performing a manipulation results in resource consumption. This vulnerability was named CVE-2022-45061. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Python up to 3.7.15/3.8.15/3.9.15/3.10.8/3.11.0 (Programming Language Software). This affects an unknown code of the component IDNA Decoder. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

The weakness was presented 11/09/2022 as 98433. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2022-45061 since 11/09/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 211093 (Fedora 38 : python3.6 (2022-f321e2cec0)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.7.16, 3.8.16, 3.9.16, 3.10.9 or 3.11.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (211093) and CERT Bund (WID-SEC-2022-2043). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• IBM AIX
• NetApp ActiveIQ Unified Manager
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• F5 BIG-IP
• SUSE Linux
• Oracle Linux
• EMC Avamar
• IBM QRadar SIEM
• Open Source Python
• Red Hat OpenShift
• SUSE openSUSE
• IBM Spectrum Protect
• RESF Rocky Linux
• Dell NetWorker

Productinfo

Type

• Programming Language Software

Name

• Python

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3
• 3.7.4
• 3.7.5
• 3.7.6
• 3.7.7
• 3.7.8
• 3.7.9
• 3.7.10
• 3.7.11
• 3.7.12
• 3.7.13
• 3.7.14
• 3.7.15
• 3.8
• 3.8.0
• 3.8.1
• 3.8.2
• 3.8.3
• 3.8.4
• 3.8.5
• 3.8.6
• 3.8.7
• 3.8.8
• 3.8.9
• 3.8.10
• 3.8.11
• 3.8.12
• 3.8.13
• 3.8.14
• 3.8.15
• 3.9
• 3.9.0
• 3.9.1
• 3.9.2
• 3.9.3
• 3.9.4
• 3.9.5
• 3.9.6
• 3.9.7
• 3.9.8
• 3.9.9
• 3.9.10
• 3.9.11
• 3.9.12
• 3.9.13
• 3.9.14
• 3.9.15
• 3.10
• 3.10.0
• 3.10.1
• 3.10.2
• 3.10.3
• 3.10.4
• 3.10.5
• 3.10.6
• 3.10.7
• 3.10.8
• 3.11.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion