Yüksek CVSS 7.5 PoC var

CVE-2022-45061: Python: güvenlik açığı

Yayın: 9 Kasım 2022 10:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Özet bilgiler

Ürün: Python Python
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: %3,33 (yüzdelik 89)
CWE: CWE-407
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
python-python	—	3.7.15	—
python-python	3.8.0	3.8.15	—
python-python	3.9.0	3.9.15	—
python-python	3.10.0	3.10.8	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
fedoraproject-fedora	35	35	—
fedoraproject-fedora	36	36	—
fedoraproject-fedora	37	37	—
netapp-active-iq-unified-manager	—	—	—
netapp-active-iq-unified-manager	—	—	—
netapp-e-series-performance-analyzer	—	—	—
netapp-element-software	—	—	—
netapp-hci	—	—	—
netapp-management-services-for-element-software	—	—	—
netapp-ontap-select-deploy-administration-utility	—	—	—
netapp-bootstrap-os	—	—	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları