An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder such that a crafted unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1 3.10.9 3.9.16 3.8.16 and 3.7.16.

🗓️ 17 Nov 2022 08:00:00Reported by MicrosoftType

Python before 3.11.1 has a quadratic internationalized domain name decoder bug causing CPU denial of service from long crafted names in Location headers.

Reporter	Title	Published	Views	Family All 478
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Certifi, Setuptools and Python may affect IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore (CVE-2022-23491, CVE-2022-40897, CVE-2022-45061)	1 Feb 202310:43	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Python may affect the IBM Storage Scale System	12 Dec 202312:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	6 Jul 202318:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Python	28 Jun 202320:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Python ( CVE-2022-45061)	3 May 202314:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities have been fixed in IBM Security Verify Access	11 May 202316:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to python ( CVE-2022-45061 )	8 Aug 202415:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Python, OpenSSH, Golang Go, Minio and Redis may affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift	26 Mar 202503:50	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in snappy-java, Python, postgresql, Golang might affect IBM Spectrum Copy Data Management	15 Dec 202313:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	5 May 202316:01	–	ibm