CVE-2020-10735

Aliases:UBUNTU-CVE-2020-10735DEBIAN-CVE-2020-10735CGA-24mp-f6g6-gwvwCGA-2h9r-9v38-jh9hCGA-4x4m-vpfv-7wm2CGA-f2vh-23v2-hp7gCGA-gc4f-qmfr-8q9mCGA-jp42-9x9m-8wcc
Advisory lineage Upstream: 0 Downstream: 27
Modified
Published: 09 Sept 2022, 00:00
Last modified:03 Nov 2025, 21:44

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
7.18% LOW
7% probability +6.87%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Sept 2022, 00:00
Published
Vulnerability first disclosed
03 Nov 2025, 21:44
Last Modified
Vulnerability information updated

Description

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 7.18%• Percentile: 94%

Techniques & Countermeasures

  • CWE-704•Incorrect Type Conversion or Cast

    The product does not correctly convert an object, resource, or structure from one type to a different type.

Affected Systems

  • chainguard•python-3.10

    < 0

  • chainguard•python-3.11

    < 0

  • chainguard•python-3.12

    < 3.12.0-r0

  • wolfi•python-3.10

    < 0

  • wolfi•python-3.11

    < 0

  • wolfi•python-3.12

    < 3.12.0-r0

  • debian•pypy3

    < 7.3.5+dfsg-2+deb11u4 | < 7.3.10+dfsg-1 | < 7.3.10+dfsg-1 | < 7.3.10+dfsg-1

  • debian•python2.7

    all

  • debian•python3.11

    < 3.11.0~rc2-1

  • debian•python3.9

    < 3.9.2-1+deb11u2

  • ubuntu•python2.7

    all | all

  • ubuntu•python3.10

    all

  • ubuntu•python3.4

    all

  • ubuntu•python3.5

    all

  • ubuntu•python3.6

    all

  • ubuntu•python3.7

    all

  • ubuntu•python3.8

    all

  • ubuntu•python3.9

    all

  • fedoraproject•fedora

    35 | 36 | 37

  • python•python

    ≥ 3.7.0, < 3.7.14 | ≥ 3.8.0, < 3.8.14 | ≥ 3.9.0, < 3.9.14 | ≥ 3.10.0, < 3.10.7 | 3.11.0:alpha1 | 3.11.0:alpha2 | 3.11.0:alpha3 | 3.11.0:alpha4 | 3.11.0:alpha5 | 3.11.0:alpha6 | 3.11.0:alpha7 | 3.11.0:beta1 | 3.11.0:beta2 | 3.11.0:beta3 | 3.11.0:beta4 | 3.11.0:beta5 | 3.11.0:rc1

  • redhat•enterprise_linux

    8.0

  • redhat•quay

    3.0.0

  • redhat•software_collections

    na

References (37)