CVE-2022-45061

Advisory lineage Upstream: 0 Downstream: 40
Modified
Published: 09 Nov 2022, 00:00
Last modified:03 Nov 2025, 21:46

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.13% LOW
0% probability +0.02%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

09 Nov 2022, 00:00
Published
Vulnerability first disclosed
03 Nov 2025, 21:46
Last Modified
Vulnerability information updated

Description

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.13%• Percentile: 32%

Techniques & Countermeasures

  • CWE-407•Inefficient Algorithmic Complexity

    An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Affected Systems

  • fedoraproject•fedora

    35 | 36 | 37

  • netapp•active_iq_unified_manager

    na

  • netapp•bootstrap_os

    na

  • netapp•e-series_performance_analyzer

    na

  • netapp•element_software

    na

  • netapp•hci

    na

  • netapp•management_services_for_element_software

    na

  • netapp•ontap_select_deploy_administration_utility

    na

  • python•python

    ≤ 3.7.15 | ≥ 3.8.0, ≤ 3.8.15 | ≥ 3.9.0, ≤ 3.9.15 | ≥ 3.10.0, ≤ 3.10.8 | 3.11.0 | 3.11.0:alpha1 | 3.11.0:alpha2 | 3.11.0:alpha3 | 3.11.0:alpha4 | 3.11.0:alpha5 | 3.11.0:alpha6 | 3.11.0:alpha7 | 3.11.0:beta1 | 3.11.0:beta2 | 3.11.0:beta3 | 3.11.0:beta4 | 3.11.0:beta5 | 3.11.0:rc1 | 3.11.0:rc2

References (36)