IM
IronMonkey Threat Research

CVE-2020-10735 HIGH

Published: 2022-09-09 | Last Modified: 2026-10-07 | Status: Modified

Description

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Additional Descriptions (1)

Se ha encontrado un fallo en python. En los algoritmos con complejidad de tiempo cuadrática que usan bases no binarias, cuando es usada int("text"), un sistema podría tardar 50ms en analizar una cadena int con 100.000 dígitos y 5s para 1.000.000 de dígitos (float, decimal, int.from_bytes(), e int() para bases binarias 2, 4, 8, 16, y 32 no están afectados). La mayor amenaza de esta vulnerabilidad es la disponibilidad del sistema

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en CWE-704
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-704

Affected Products

Vendor Product Version Update Type
python python * <built-in method update of dict object at 0x7fd36978a700> Application
python python * <built-in method update of dict object at 0x7fd31b247740> Application
python python * <built-in method update of dict object at 0x7fd31b244940> Application
python python * <built-in method update of dict object at 0x7fd31b244980> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd3841217c0> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd384120940> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd289d3d440> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd369418f80> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd36bef9640> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd34927ca40> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd340a11640> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd31b245640> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd36941ae40> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd36bef8540> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd369418700> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd369418080> Application
python python 3.11.0 <built-in method update of dict object at 0x7fd36a699540> Application
redhat quay 3.0.0 <built-in method update of dict object at 0x7fd384658940> Application
redhat software_collections - <built-in method update of dict object at 0x7fd384121740> Application
fedoraproject fedora 35 <built-in method update of dict object at 0x7fd340a13180> Operating System
fedoraproject fedora 36 <built-in method update of dict object at 0x7fd342021340> Operating System
fedoraproject fedora 37 <built-in method update of dict object at 0x7fd31b245e00> Operating System
redhat enterprise_linux 8.0 <built-in method update of dict object at 0x7fd2dbc7b280> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:alpha1:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:alpha2:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:alpha3:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:alpha4:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:alpha5:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:alpha6:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:alpha7:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:beta1:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:beta2:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:beta3:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:beta4:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:beta5:*:*:*:*:*:*
Yes cpe:2.3:a:python:python:3.11.0:rc1:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

References