Lucene search

RedhatCVE-2020-10735

HistorySep 09, 2022 - 2:15 p.m.

CVE-2020-10735

2022-09-0914:15:08

CWE-704

redhat

web.nvd.nist.gov

486

cve-2020-10735

python

vulnerability

system availability

quadratic time complexity

int parsing

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.006

Percentile

77.9%

JSON

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(“text”), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Affected configurations

Nvd

Vulners

Node

pythonpythonRange3.7.0–3.7.14

pythonpythonRange3.8.0–3.8.14

pythonpythonRange3.9.0–3.9.14

pythonpythonRange3.10.0–3.10.7

pythonpythonMatch3.11.0alpha1

pythonpythonMatch3.11.0alpha2

pythonpythonMatch3.11.0alpha3

pythonpythonMatch3.11.0alpha4

pythonpythonMatch3.11.0alpha5

pythonpythonMatch3.11.0alpha6

pythonpythonMatch3.11.0alpha7

pythonpythonMatch3.11.0beta1

pythonpythonMatch3.11.0beta2

pythonpythonMatch3.11.0beta3

pythonpythonMatch3.11.0beta4

pythonpythonMatch3.11.0beta5

pythonpythonMatch3.11.0rc1

Node

redhatquayMatch3.0.0

redhatsoftware_collectionsMatch-

fedoraprojectfedoraMatch35

fedoraprojectfedoraMatch36

fedoraprojectfedoraMatch37

redhatenterprise_linuxMatch8.0

VendorProductVersionCPE
pythonpython*cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha1:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha2:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha3:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha4:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha5:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha6:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:alpha7:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:beta1:*:*:*:*:*:*
pythonpython3.11.0cpe:2.3:a:python:python:3.11.0:beta2:*:*:*:*:*:*

Vendor	Product	Version	CPE
python	python	*	cpe:2.3:a:python:python::::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha1::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha2::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha3::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha4::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha5::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha6::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:alpha7::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:beta1::::::
python	python	3.11.0	cpe:2.3:a:python:python:3.11.0:beta2::::::

Rows per page:

1-10 of 201

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "python",
    "versions": [
      {
        "version": "python 3.7",
        "status": "affected"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2022/09/21/1

www.openwall.com/lists/oss-security/2022/09/21/4

access.redhat.com/security/cve/CVE-2020-10735

bugzilla.redhat.com/show_bug.cgi?id=1834423

docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y

github.com/python/cpython/issues/95778

lists.debian.org/debian-lts-announce/2023/06/msg00039.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2VCU6EVQDIXNCEDJUCTFIER2WVNNDTYZ/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/32AAQKABEKFCB5DDV5OONRZK6BS23HPW/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4EWKR2SPX3JORLWCXFY3KN2U5B5CIUQQ/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XL6E5A3I36TRR73VNBOXNIQP4AMZDFZ/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/76YE7AM37MRU76XJV4M27CWDAMUGNRYK/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HSRPVJZL6DJFWKYRHMNJB7VCEUCBKRF5/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFGV7P2PYFBMK32OKHCAC2ZPJQV5AUDF/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHC6IUU7CLRQ3QLPWUXLONSG3SXFTR47/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKYE2DOI2X7WZXAWTQJZAXYIWM37HDCY/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5U223OE5ZOUHZAZYSYSWVJQIKDE73E/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OT5WQB7Z3CXOWVBD2AFAHYPA5ONYFFZ4/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD7FTLJOIGMUSCDR3JAN6WRFHJEE4PH5/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZYJSGLSCQOKXXFVJVJQAXLEOJBIWGEL/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TD7JDDKJXK6D26XAN3YRFNM2LAJHT5UO/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMWPRAAJS7I6U3U45V7GZVXWNSECI22M/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4ZZV4CDFRMTPDBI7C5L43RFL3XLIGUY/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBPDVCDIUCEBE7C4NAGNA2KQJYOTPBAZ/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V7ZUJDHK7KNG6SLIFXW7MNZ6O2PUJYK6/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXF6MQ74HVIDDSR5AE2UDR24I6D4FEPC/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZEOAJWGGY55QU35UM2OVZATBW5MX2OZD/

Social References

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.006

Percentile

77.9%

JSON

Related for CVE-2020-10735