Vulnerabilities > CVE-2022-45061 - Algorithmic Complexity vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

network

low complexity

NVD

Published: 2022-11-09

Updated: 2023-11-07

Summary

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Vulnerable Configurations

Part	Description	Count
Application	Python Python Python 3.11.0 Python Python - Python Python 0.9.0 Python Python 0.9.1 Python Python 0.9.8 Python Python 0.9.9 Python Python 1.0.1 Python Python 1.0.2 Python Python 1.1 Python Python 1.1.1 Python Python 1.2 Python Python 1.3 Python Python 1.4 Python Python 1.5 Python Python 1.5.1 Python Python 1.5.2 Python Python 1.6 Python Python 1.6.1 Python Python 2.0 Python Python 2.0.1 Python Python 2.1 Python Python 2.1.1 Python Python 2.1.2 Python Python 2.1.3 Python Python 2.2 Python Python 2.2.0 Python Python 2.2.1 Python Python 2.2.2 Python Python 2.2.3 Python Python 2.3 Python Python 2.3.0 Python Python 2.3.1 Python Python 2.3.2 Python Python 2.3.3 Python Python 2.3.4 Python Python 2.3.5 Python Python 2.3.6 Python Python 2.3.7 Python Python 2.4 Python Python 2.4.0 Python Python 2.4.1 Python Python 2.4.2 Python Python 2.4.3 Python Python 2.4.4 Python Python 2.4.5 Python Python 2.4.6 Python Python 2.5 Python Python 2.5.0 Python Python 2.5.1 Python Python 2.5.2 Python Python 2.5.3 Python Python 2.5.4 Python Python 2.5.5 Python Python 2.5.6 Python Python 2.5.150 Python Python 2.6 Python Python 2.6.0 Python Python 2.6.1 Python Python 2.6.2 Python Python 2.6.3 Python Python 2.6.4 Python Python 2.6.5 Python Python 2.6.6 Python Python 2.6.7 Python Python 2.6.8 Python Python 2.6.9 Python Python 2.6.2150 Python Python 2.6.6150 Python Python 2.7 Python Python 2.7.0 Python Python 2.7.1 Python Python 2.7.2 Python Python 2.7.3 Python Python 2.7.4 Python Python 2.7.5 Python Python 2.7.6 Python Python 2.7.7 Python Python 2.7.8 Python Python 2.7.9 Python Python 2.7.10 Python Python 2.7.11 Python Python 2.7.12 Python Python 2.7.13 Python Python 2.7.14 Python Python 2.7.15 Python Python 2.7.16 Python Python 2.7.17 Python Python 2.7.18 Python Python 2.7.1150 Python Python 2.7.2150 Python Python 3.0 Python Python 3.0.0 Python Python 3.0.1 Python Python 3.1 Python Python 3.1.0 Python Python 3.1.1 Python Python 3.1.2 Python Python 3.1.3 Python Python 3.1.4 Python Python 3.1.5 Python Python 3.1.2150 Python Python 3.2 Python Python 3.2.0 Python Python 3.2.1 Python Python 3.2.2 Python Python 3.2.3 Python Python 3.2.4 Python Python 3.2.5 Python Python 3.2.6 Python Python 3.2.2150 Python Python 3.3 Python Python 3.3.0 Python Python 3.3.1 Python Python 3.3.2 Python Python 3.3.3 Python Python 3.3.4 Python Python 3.3.5 Python Python 3.3.6 Python Python 3.3.7 Python Python 3.4 Python Python 3.4.0 Python Python 3.4.1 Python Python 3.4.2 Python Python 3.4.3 Python Python 3.4.4 Python Python 3.4.5 Python Python 3.4.6 Python Python 3.4.7 Python Python 3.4.8 Python Python 3.4.9 Python Python 3.4.10 Python Python 3.5 Python Python 3.5.0 Python Python 3.5.1 Python Python 3.5.2 Python Python 3.5.3 Python Python 3.5.4 Python Python 3.5.5 Python Python 3.5.6 Python Python 3.5.7 Python Python 3.5.8 Python Python 3.5.9 Python Python 3.5.10 Python Python 3.6 Python Python 3.6.0 Python Python 3.6.1 Python Python 3.6.2 Python Python 3.6.3 Python Python 3.6.4 Python Python 3.6.5 Python Python 3.6.6 Python Python 3.6.7 Python Python 3.6.8 Python Python 3.6.9 Python Python 3.6.10 Python Python 3.6.11 Python Python 3.6.12 Python Python 3.6.13 Python Python 3.6.14 Python Python 3.6.15 Python Python 3.6.16 Python Python 3.7 Python Python 3.7.0 Python Python 3.7.1 Python Python 3.7.2 Python Python 3.7.3 Python Python 3.7.4 Python Python 3.7.5 Python Python 3.7.6 Python Python 3.7.7 Python Python 3.7.8 Python Python 3.7.9 Python Python 3.7.10 Python Python 3.7.11 Python Python 3.7.12 Python Python 3.7.13 Python Python 3.7.14 Python Python 3.7.15 Python Python 3.8.0 Python Python 3.8.0B1 Python Python 3.8.1 Python Python 3.8.2 Python Python 3.8.3 Python Python 3.8.4 Python Python 3.8.5 Python Python 3.8.6 Python Python 3.8.7 Python Python 3.8.8 Python Python 3.8.9 Python Python 3.8.10 Python Python 3.8.11 Python Python 3.8.12 Python Python 3.8.13 Python Python 3.8.14 Python Python 3.8.15 Python Python 3.9.0 Python Python 3.9.1 Python Python 3.9.2 Python Python 3.9.3 Python Python 3.9.4 Python Python 3.9.5 Python Python 3.9.6 Python Python 3.9.7 Python Python 3.9.8 Python Python 3.9.9 Python Python 3.9.10 Python Python 3.9.11 Python Python 3.9.12 Python Python 3.9.13 Python Python 3.9.14 Python Python 3.9.15 Python Python 3.10.0 Python Python 3.10.1 Python Python 3.10.2 Python Python 3.10.3 Python Python 3.10.4	500
Application	Netapp Netapp Element Software - Netapp Ontap Select Deploy Administration Utility - Netapp HCI - Netapp Active IQ Unified Manager - Netapp E Series Performance Analyzer - Netapp Management Services FOR Element Software -	7
OS	Fedoraproject Fedoraproject Fedora 35 Fedoraproject Fedora 36 Fedoraproject Fedora 37	3
OS	Netapp Netapp Bootstrap OS -	1
Hardware	Netapp Netapp HCI Compute Node -	1

Common Weakness Enumeration (CWE)

CWE-407 - Algorithmic Complexity

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References