CVE-2022-45061

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. This package Provides python version 3.

Security Fix(es):

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.(CVE-2022-45061)

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS (CVE-2020-10735)

• python: open redirection vulnerability in lib/http/server.py may lead to information disclosure (CVE-2021-28861)

• Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python38 (3.8.16).

Security Fix(es):

• python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS (CVE-2020-10735)

• python: open redirection vulnerability in lib/http/server.py may lead to information disclosure (CVE-2021-28861)

• python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python39 (3.9.16).

Security Fix(es):

• python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS (CVE-2020-10735)

• python: open redirection vulnerability in lib/http/server.py may lead to information disclosure (CVE-2021-28861)

• python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

Security Fix(es):

• Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS (CVE-2020-10735)
• python: open redirection vulnerability in lib/http/server.py may lead to information disclosure (CVE-2021-28861)
• Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

• Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python38 (3.8.16).

Security Fix(es):

• python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS (CVE-2020-10735)
• python: open redirection vulnerability in lib/http/server.py may lead to information disclosure (CVE-2021-28861)
• python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

The following packages have been upgraded to a later upstream version: python39 (3.9.16).

Security Fix(es):

• python: int() type in PyLong_FromString() does not limit amount of digits converting text to int leading to DoS (CVE-2020-10735)
• python: open redirection vulnerability in lib/http/server.py may lead to information disclosure (CVE-2021-28861)
• python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing. The python27 packages provide a stable release of Python 2.7 with a number of additional utilities and database connectors for MySQL and PostgreSQL.

Security Fix(es):

• Python: CPU denial of service via inefficient IDNA decoder (CVE-2022-45061)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

• CVE-2022-45061: Fix quadratic time idna decoding
• fix tests to be compatible with expat 2.0.1-tuxcare.els

• CVE-2022-45061: Fix quadratic time idna decoding

• CVE-2022-45061: Fix quadratic time idna decoding
• fix tests to be compatible with expat 2.2.5

• CVE-2022-45061: Fix quadratic time idna decoding

• CVE-2022-45061: Fix quadratic time idna decoding
• fix tests to be compatible with expat 2.2.5

• CVE-2022-45061: Fix quadratic time idna decoding
• fix tests to be compatible with expat 2.0.1-tuxcare.els

• SECURITY UPDATE: Uncontrolled resource consumption
  • debian/patches/CVE-2022-45061-v2.7.patch: Fix quadratic time idna decoding
  • CVE-2022-45061
• Make tests to be compatible with expat 2.1.0 from tuxcare.els:
  • debian/patches/expat-regression-v2.7.patch: Make test suite support Expat >=2.4.5

• SECURITY UPDATE: Uncontrolled resource consumption
  • debian/patches/CVE-2022-45061.patch: Fix quadratic time idna decoding
  • CVE-2022-45061
• Fix the tests: Certificates were expired
  • debian/patches/update-test-certs-and-keys.patch: Update test certs and keys

• CVE-2021-3737: Fix http client infinite line reading (DoS) after a HTTP 100 Continue
• CVE-2021-28861: Fix an open redirection vulnerability in http.server
• CVE-2022-0391: Make urllib.parse sanitize urls containing ASCII newline and tabs
• CVE-2022-45061: Fix quadratic time idna decoding

• CVE-2022-45061: fix quadratic time idna decoding
• CVE-2021-3737: fix http client infinite line reading (DoS) after a HTTP 100 Continue

• SECURITY UPDATE: URL parsing accepts ASCII tab/CR/LF (URL smuggling)
  • debian/patches/CVE-2022-0391.patch: sanitise tab, CR, LF anywhere in URL/scheme inside urlsplit() before cache lookup, plus regression test in Lib/urlparse.py, Lib/test/test_urlparse.py.
  • CVE-2022-0391
• SECURITY UPDATE: Quadratic complexity in IDNA decoding (DoS)
  • debian/patches/CVE-2022-45061.patch: replace O(n) outer loop with a single any() guard in nameprep(), plus regression test in Lib/encodings/idna.py, Lib/test/test_codecs.py.
  • CVE-2022-45061
• SECURITY UPDATE: ReDoS in Cookie._unquote (quadratic backslash parsing)
  • debian/patches/CVE-2024-7592.patch: replace the quadratic _OctalPatt / _QuotePatt loop with a single linear re.sub-based decoder, plus regression tests in Lib/Cookie.py, Lib/test/test_cookie.py.
  • CVE-2024-7592
• SECURITY UPDATE: webbrowser.open() argument injection via leading dash
  • debian/patches/CVE-2026-4519.patch: add BaseBrowser._check_url() and call it from every browser open() to reject URLs whose first non-whitespace char is '-', plus regression test in Lib/webbrowser.py, Lib/test/test_webbrowser.py. Also backports upstream gh-148169 (commit d22922c8a7) to close the %action-substitution bypass: the check is deferred until after %action substitution and the per-arg replace() chain is reordered (%action before %s) so an attacker cannot smuggle a leading dash via the URL.
  • CVE-2026-4519
• BUILD: replace libdb-dev (<< 1:6.0) with libdb5.3-dev in debian/control{,.in} so the build pulls the explicit Berkeley DB 5.3 development headers available on Ubuntu 20.04 ESM, instead of the virtual libdb-dev package that is no longer satisfied in the ELS build environment.

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. (CVE-2022-45061) An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities. (CVE-2022-48565) An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest. (CVE-2022-48566) An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. (CVE-2023-24329) An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket). (CVE-2023-40217)

These are all security issues fixed in the python311-3.11.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-2.7.18-25.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-3.10.8-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python38-3.8.15-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python39-3.9.15-3.1 package on the GA media of openSUSE Tumbleweed.