REDHAT-BUG-1834423: Medium severity cpython vulnerability
A vulnerability was found in PyLongFromString() in Python, which is used by int("text"). For non-binary bases it uses an algorithm with quadratic time complexity to convert a string into an arbitrary precision number. It takes about 50ms to parse an int string with 100,000 digits and about 5sec for 1,000,000 digits. The float type, decimal type, int.frombytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1834423?
The severity of REDHAT-BUG-1834423 is considered significant due to its impact on performance with large integer strings.
How do I fix REDHAT-BUG-1834423?
To fix REDHAT-BUG-1834423, update to the patched version of Python provided by your distribution.
What versions of Python are affected by REDHAT-BUG-1834423?
All versions of Python using the affected PyLong_FromString() function are susceptible to REDHAT-BUG-1834423.
What is the impact of REDHAT-BUG-1834423?
The impact of REDHAT-BUG-1834423 includes potential denial of service due to excessive parsing times for large integer strings.
Is REDHAT-BUG-1834423 a known vulnerability?
Yes, REDHAT-BUG-1834423 is a documented vulnerability that has been reported and tracked in various bug databases.