What is CVE-2022-45061?

CVE-2022-45061 is a vulnerability affecting certain versions of Python, specifically those before version 3.11.1. The issue lies in an unnecessary quadratic algorithm in one path when processing some inputs to the IDNA (RFC 3490) decoder. This can lead to slow execution times and potential denial of service attacks on systems running affected Python versions. Systems that utilize Python's idna module for decoding large strings, such as web servers or applications handling user-provided hostnames, may be impacted by this vulnerability.

Who is impacted by CVE-2022-45061?

The CVE-2022-45061 vulnerability affects users of Python before version 3.11.1, specifically those who use IDNA decoding with large strings. Impacted versions include Python 3.7.15 and earlier, 3.8.0 to 3.8.15, 3.9.0 to 3.9.15, 3.10.0 to 3.10.8, and 3.11.0. Additionally, users of Python 2.7 may also be affected. This issue can lead to slow execution times and potential denial of service attacks on systems running these Python versions, particularly when processing large inputs.

What to do if CVE-2022-45061 affected you

If you're affected by the CVE-2022-45061 vulnerability, it's important to take action to protect your system. Here's a simple, non-technical explanation of what you should do:

1. Update your Python version to the latest available release, as mentioned in the GitHub issue.

2. For Python 2.7 users, consider upgrading to the recommended version mentioned in the Debian security update.

3. Be cautious when processing large strings with the IDNA decoder, and consider implementing an upfront length check to reject overly long inputs.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-45061 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-407, which involves inefficient algorithmic complexity in Python's IDNA decoder.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the National Vulnerability Database or refer to the sources below.

• Slow IDNA decoding with large strings [CVE-2022-45061]

• [SECURITY] [DLA 3432-1] python2.7 security update