CVE-2022-45061: High severity python 2.7 vulnerability
A vulnerability was discovered in Python. A quadratic algorithm exists when processing inputs to the IDNA (RFC 3490) decoder, such that a crafted unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor, which could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied hostname.
Other sources
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.
Python is vulnerable to a denial of service, caused by an unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause a CPU denial of service condition.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-45061?
CVE-2022-45061 is a vulnerability discovered in Python before 3.11.1 that allows for a CPU denial of service when processing certain inputs to the IDNA decoder.
How severe is CVE-2022-45061?
CVE-2022-45061 is considered a high severity vulnerability with a CVSS severity score of 7.0.
What is the affected software?
The affected software includes Python versions 3.6.8-48.el8_7.1, 3.9.14-1.el9_1.2, and versions 3.10.0 to 3.10.8.
How can I fix CVE-2022-45061?
To fix CVE-2022-45061, upgrade to Python version 3.11.1 or apply the provided patches.
Where can I find more information about CVE-2022-45061?
You can find more information about CVE-2022-45061 in the references provided: [link1](https://github.com/python/cpython/issues/98433), [link2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144417), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144426).