CVE-2022-45061

python, fedoraproject fedora, netapp active iq unified manager +6 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-45061

Katalog CVE

CVSS 7.5 · High EPSS 2,7%

Kerentanan Inefficient Algorithmic Complexity pada python, fedoraproject fedora +7 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

Rincian

Terbit di NVD
9 November 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-407: Inefficient Algorithmic Complexity
EPSS (30 hari)
2,7% peluang dieksploitasi; lebih tinggi dari 85,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
python python Semua versi hingga 3.7.15
python python Versi 3.8.0 hingga 3.8.15
python python Versi 3.9.0 hingga 3.9.15
python python Versi 3.10.0 hingga 3.10.8
python python Versi 3.11.0
python python Versi 3.11.0 alpha1
python python Versi 3.11.0 alpha2
python python Versi 3.11.0 alpha3
python python Versi 3.11.0 alpha4
python python Versi 3.11.0 alpha5
python python Versi 3.11.0 alpha6
python python Versi 3.11.0 alpha7
python python Versi 3.11.0 beta1
python python Versi 3.11.0 beta2
python python Versi 3.11.0 beta3
python python Versi 3.11.0 beta4
python python Versi 3.11.0 beta5
python python Versi 3.11.0 rc1
python python Versi 3.11.0 rc2
fedoraproject fedora Versi 35
fedoraproject fedora Versi 36
fedoraproject fedora Versi 37
netapp active iq unified manager Semua versi
netapp e-series performance analyzer Semua versi
netapp element software Semua versi
netapp hci Semua versi
netapp management services for element software Semua versi
netapp ontap select deploy administration utility Semua versi
netapp bootstrap os Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.