Описание
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| python3.11 | fixed | 3.11.0~rc2-1 | package | |
| python3.10 | fixed | 3.10.7-1 | package | |
| python3.9 | removed | package | ||
| python3.7 | removed | package | ||
| python2.7 | removed | package | ||
| python2.7 | ignored | bullseye | package | |
| python2.7 | ignored | buster | package | |
| pypy3 | fixed | 7.3.10+dfsg-1 | package | |
| pypy3 | no-dsa | buster | package |
Примечания
https://github.com/python/cpython/issues/95778
https://github.com/python/cpython/pull/96499
https://github.com/python/cpython/commit/f8b71da9aac6ea74808dcdd0cc266e705431356b (v3.11.0rc2)
https://github.com/python/cpython/commit/8f0fa4bd10aba723aff988720cd26b93be99bc12 (v3.10.7)
https://github.com/python/cpython/commit/cec1e9dfd769bd3a16142d0fdd1a36f19c77ed15 (v3.9.14)
https://github.com/python/cpython/commit/15ec1afd4fcd2da1e2d2b256c562fb42d8d886a2 (v3.7.14)
EPSS
Связанные уязвимости
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.
EPSS