CVE-2022-45061
First published: Wed Nov 09 2022(Updated: )
A vulnerability was discovered in Python. A quadratic algorithm exists when processing inputs to the IDNA (RFC 3490) decoder, such that a crafted unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor, which could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied hostname.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/python3 | <0:3.6.8-48.el8_7.1 | 0:3.6.8-48.el8_7.1 |
| redhat/python3.9 | <0:3.9.14-1.el9_1.2 | 0:3.9.14-1.el9_1.2 |
| IBM Cloud Pak for Security | <=1.10.0.0 - 1.10.11.0 | |
| IBM QRadar Suite Software | <=1.10.12.0 - 1.10.16.0 | |
| redhat/python | <3.11.1 | 3.11.1 |
| redhat/python | <3.10.9 | 3.10.9 |
| redhat/python | <3.9.16 | 3.9.16 |
| redhat/python | <3.8.16 | 3.8.16 |
| redhat/python | <3.7.16 | 3.7.16 |
| ubuntu/python2.7 | <2.7.17-1~18.04ubuntu1.10 | 2.7.17-1~18.04ubuntu1.10 |
| ubuntu/python2.7 | <2.7.6-8ubuntu0.6+ | 2.7.6-8ubuntu0.6+ |
| ubuntu/python2.7 | <2.7.12-1ubuntu0~16.04.18+ | 2.7.12-1ubuntu0~16.04.18+ |
| ubuntu/python3.10 | <3.10.6-1~22.04.2 | 3.10.6-1~22.04.2 |
| ubuntu/python3.10 | <3.10.7-1ubuntu0.2 | 3.10.7-1ubuntu0.2 |
| ubuntu/python3.11 | <3.11.1 | 3.11.1 |
| ubuntu/python3.5 | <3.5.2-2ubuntu0~16.04.13+ | 3.5.2-2ubuntu0~16.04.13+ |
| ubuntu/python3.6 | <3.6.9-1~18.04ubuntu1.9 | 3.6.9-1~18.04ubuntu1.9 |
| ubuntu/python3.8 | <3.8.10-0ubuntu1~20.04.6 | 3.8.10-0ubuntu1~20.04.6 |
| ubuntu/python3.9 | <3.9.5-3ubuntu0~20.04.1+ | 3.9.5-3ubuntu0~20.04.1+ |
| debian/python2.7 | <=2.7.16-2+deb10u1<=2.7.18-8+deb11u1 | 2.7.16-2+deb10u4 |
| debian/python3.11 | 3.11.2-6 3.11.8-1 3.11.9-1 | |
| debian/python3.7 | <=3.7.3-2+deb10u3 | 3.7.3-2+deb10u7 |
| debian/python3.9 | <=3.9.2-1 | |
| Python Python | <=3.7.15 | |
| Python Python | >=3.8.0<=3.8.15 | |
| Python Python | >=3.9.0<=3.9.15 | |
| Python Python | >=3.10.0<=3.10.8 | |
| Python Python | =3.11.0 | |
| Python Python | =3.11.0-alpha1 | |
| Python Python | =3.11.0-alpha2 | |
| Python Python | =3.11.0-alpha3 | |
| Python Python | =3.11.0-alpha4 | |
| Python Python | =3.11.0-alpha5 | |
| Python Python | =3.11.0-alpha6 | |
| Python Python | =3.11.0-alpha7 | |
| Python Python | =3.11.0-beta1 | |
| Python Python | =3.11.0-beta2 | |
| Python Python | =3.11.0-beta3 | |
| Python Python | =3.11.0-beta4 | |
| Python Python | =3.11.0-beta5 | |
| Python Python | =3.11.0-rc1 | |
| Python Python | =3.11.0-rc2 | |
| Fedoraproject Fedora | =35 | |
| Fedoraproject Fedora | =36 | |
| Fedoraproject Fedora | =37 | |
| Netapp Active Iq Unified Manager Vmware Vsphere | ||
| Netapp Active Iq Unified Manager Windows | ||
| Netapp E-series Performance Analyzer | ||
| Netapp Element Software | ||
| Netapp Hci | ||
| Netapp Management Services For Element Software | ||
| NetApp ONTAP Select Deploy administration utility | ||
| Netapp Bootstrap Os | ||
| Netapp Hci Compute Node | ||
| All of | ||
| Netapp Bootstrap Os | ||
| Netapp Hci Compute Node |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-45061 https://nvd.nist.gov/vuln/detail/CVE-2022-45061 https://github.com/python/cpython/issues/98433 https://python-security.readthedocs.io/vuln/slow-idna-large-strings.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2144072
- https://access.redhat.com/errata/RHSA-2023:0833
- https://access.redhat.com/errata/RHSA-2023:2763
- https://access.redhat.com/errata/RHSA-2023:2764
- https://access.redhat.com/errata/RHSA-2023:2860
- https://access.redhat.com/errata/RHSA-2023:0953
- https://access.redhat.com/security/cve/cve-2022-45061
- https://github.com/python/cpython/issues/98433
- https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2AOUKI72ACV6CHY2QUFO6VK2DNMVJ2MB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/35YDIWCUMWTMDBWFRAVENFH6BLB65D6S/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4WBZJNSALFGMPYTINIF57HAAK46U72WQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63FS6VHY4DCS74HBTEINUDOECQ2X6ZCH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WQPHKGNXUJC3TC3BDW5RKGROWRJVSFR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B3YI6JYARWU6GULWOHNUROSACT54XFFS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4MYQ3IV6NWA4CKSXEHW45CH2YNDHEPH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BWJREJHWVRBYDP43YB5WRL3QC7UBA7BR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GTPVDZDATRQFE6KAT6B4BQIQ4GRHIIIJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IN26PWZTYG6IF3APLRXQJBVACQHZUPT2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCDJXNBHWXNYUTOEV4H2HCFSRKV3SYL3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JTYVESWVBPD57ZJC35G5722Q6TS37WSB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KNE4GMD45RGC2HWUAAIGTDHT5VJ2E4O4/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKWAMPURWUV3DCCT4J7VHRF4NT2CFVBR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O67LRHDTJWH544KXB6KY4HMHQLYDXFPK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORVCQGJCCAVLN4DJDTWGREFCUWXKQRML/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PLQ2BNZVBBAQPV3SPRU24ZD37UYJJS7W/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QCKD4AFBHXIMHS64ZER2U7QRT33HNE7L/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RH57BNT4VQERGEJ5SXNXSVMDYP66YD4H/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RTN2OOLKYTG34DODUEJGT5MLC2PFGPBA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3D5TX4TDJPXHXD2QICKTY3OCQC3JARP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UHVW73QZJMHA4MK7JBT7CXX7XSNYQEGF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VCMDX6IFKLOA3NXUQEV524L5LHTPI2JI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X3EJ6J7PXVQOULBQZQGBXCXY6LFF6LZD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXZJL3CNAFS5PAIR7K4RL62S3Y7THR7O/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YPNWZKXPKTNHS5FVMN7UQZ2UPCSEFJUK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB5YCMIRVX35RUB6XPOWKENCVCJEVDRK/
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20221209-0007/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/240593
- https://www.ibm.com/support/pages/node/7080058 (Advisory)
- https://launchpad.net/bugs/cve/CVE-2022-45061
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AOUKI72ACV6CHY2QUFO6VK2DNMVJ2MB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35YDIWCUMWTMDBWFRAVENFH6BLB65D6S/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WBZJNSALFGMPYTINIF57HAAK46U72WQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FS6VHY4DCS74HBTEINUDOECQ2X6ZCH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WQPHKGNXUJC3TC3BDW5RKGROWRJVSFR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3YI6JYARWU6GULWOHNUROSACT54XFFS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4MYQ3IV6NWA4CKSXEHW45CH2YNDHEPH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BWJREJHWVRBYDP43YB5WRL3QC7UBA7BR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTPVDZDATRQFE6KAT6B4BQIQ4GRHIIIJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN26PWZTYG6IF3APLRXQJBVACQHZUPT2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCDJXNBHWXNYUTOEV4H2HCFSRKV3SYL3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JTYVESWVBPD57ZJC35G5722Q6TS37WSB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KNE4GMD45RGC2HWUAAIGTDHT5VJ2E4O4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKWAMPURWUV3DCCT4J7VHRF4NT2CFVBR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O67LRHDTJWH544KXB6KY4HMHQLYDXFPK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORVCQGJCCAVLN4DJDTWGREFCUWXKQRML/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PLQ2BNZVBBAQPV3SPRU24ZD37UYJJS7W/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QCKD4AFBHXIMHS64ZER2U7QRT33HNE7L/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QLUGZSEAO3MBWGKCUSMKQIRYJZKJCIOB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RDK3ZZBRYFO47ET3N4BNTKVXN47U6ICY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH57BNT4VQERGEJ5SXNXSVMDYP66YD4H/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTN2OOLKYTG34DODUEJGT5MLC2PFGPBA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3D5TX4TDJPXHXD2QICKTY3OCQC3JARP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHVW73QZJMHA4MK7JBT7CXX7XSNYQEGF/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMDX6IFKLOA3NXUQEV524L5LHTPI2JI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3EJ6J7PXVQOULBQZQGBXCXY6LFF6LZD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XXZJL3CNAFS5PAIR7K4RL62S3Y7THR7O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPNWZKXPKTNHS5FVMN7UQZ2UPCSEFJUK/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB5YCMIRVX35RUB6XPOWKENCVCJEVDRK/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144417
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144426
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144428
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144429
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144430
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144418
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144419
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144420
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144421
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144422
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144423
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144424
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144425
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144416
- https://access.redhat.com/errata/RHSA-2023:6793
- https://access.redhat.com/errata/RHSA-2024:0430
- https://github.com/python/cpython/pull/99092
- https://github.com/python/cpython/commit/a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15
- https://github.com/python/cpython/commit/9bb8e18ca46fe66fa6802602f8a7228a24dd785f
- https://github.com/python/cpython/commit/c09dba57cfbbf74273ce44b1f48f71b46806605c
- https://github.com/python/cpython/commit/82ca2839c9ec6bf9a9400e791a52411824df67f3
- https://github.com/python/cpython/commit/b0b590be9597fd5919228d251812dd54145f70a7
- https://security-tracker.debian.org/tracker/CVE-2022-45061
- https://github.com/python/cpython/pull/99230 (3.9-branch)
- https://github.com/python/cpython/pull/99231 (3.8-branch)
- https://ubuntu.com/security/notices/USN-5767-1
- https://ubuntu.com/security/notices/USN-5767-2
- https://ubuntu.com/security/notices/USN-5888-1
- https://www.cve.org/CVERecord?id=CVE-2022-45061
- https://nvd.nist.gov/vuln/detail/CVE-2022-45061
- https://ubuntu.com/security/CVE-2022-45061
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2022-45061?
CVE-2022-45061 is a vulnerability discovered in Python before 3.11.1 that allows for a CPU denial of service when processing certain inputs to the IDNA decoder.
How severe is CVE-2022-45061?
CVE-2022-45061 is considered a high severity vulnerability with a CVSS severity score of 7.0.
What is the affected software?
The affected software includes Python versions 3.6.8-48.el8_7.1, 3.9.14-1.el9_1.2, and versions 3.10.0 to 3.10.8.
How can I fix CVE-2022-45061?
To fix CVE-2022-45061, upgrade to Python version 3.11.1 or apply the provided patches.
Where can I find more information about CVE-2022-45061?
You can find more information about CVE-2022-45061 in the references provided: [link1](https://github.com/python/cpython/issues/98433), [link2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144417), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2144426).
- collector/redhat-cve
- collector/ibm-support
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/severity
- agent/author
- agent/remedy
- agent/weakness
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-45061
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- collector/nvd-cve
- source/NVD
- package-manager/redhat
- vendor/ibm
- canonical/ibm cloud pak for security
- version/ibm cloud pak for security/1.10.0.0 - 1.10.11.0
- canonical/ibm qradar suite software
- version/ibm qradar suite software/1.10.12.0 - 1.10.16.0
- package-manager/ubuntu
- package-manager/debian
- vendor/python
- canonical/python python
- version/python python/3.7.15
- version/python python/3.8.0
- version/python python/3.8.15
- version/python python/3.9.0
- version/python python/3.9.15
- version/python python/3.10.0
- version/python python/3.10.8
- version/python python/3.11.0
- version/python python/3.11.0-alpha1
- version/python python/3.11.0-alpha2
- version/python python/3.11.0-alpha3
- version/python python/3.11.0-alpha4
- version/python python/3.11.0-alpha5
- version/python python/3.11.0-alpha6
- version/python python/3.11.0-alpha7
- version/python python/3.11.0-beta1
- version/python python/3.11.0-beta2
- version/python python/3.11.0-beta3
- version/python python/3.11.0-beta4
- version/python python/3.11.0-beta5
- version/python python/3.11.0-rc1
- version/python python/3.11.0-rc2
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- version/fedoraproject fedora/36
- version/fedoraproject fedora/37
- vendor/netapp
- canonical/netapp active iq unified manager vmware vsphere
- canonical/netapp active iq unified manager windows
- canonical/netapp e-series performance analyzer
- canonical/netapp element software
- canonical/netapp hci
- canonical/netapp management services for element software
- canonical/netapp ontap select deploy administration utility
- canonical/netapp bootstrap os
- canonical/netapp hci compute node