CVEvulnerability

CVE-2020-10735

7.5 HIGH Published 2022-09-09 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2022-09-09
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.2 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-704

Description

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Affected configurations

• python python (>= 3.7.0 < 3.7.14) • python python (>= 3.8.0 < 3.8.14) • python python (>= 3.9.0 < 3.9.14) • python python (>= 3.10.0 < 3.10.7) • python python 3.11.0 • redhat quay 3.0.0 • redhat software collections • fedoraproject fedora 35 • fedoraproject fedora 36 • fedoraproject fedora 37 • redhat enterprise linux 8.0

Related

Weakness · CWE (1)

  • CWE-704 Incorrect Type Conversion or Cast weakness

Referenced by CWE · observed example (2)

  • CWE-405 Asymmetric Resource Consumption (Amplification) weakness
  • CWE-407 Inefficient Algorithmic Complexity weakness

References