CVE-2020-10735

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-10735
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10735.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-10735
Aliases
Downstream
Related
Published
2022-09-09T14:15:08.660Z
Modified
2026-07-08T05:55:14.209177557Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "35"
                },
                {
                    "last_affected": "35"
                },
                {
                    "introduced": "36"
                },
                {
                    "last_affected": "36"
                },
                {
                    "introduced": "37"
                },
                {
                    "last_affected": "37"
                }
            ],
            "vendor_product": "fedoraproject:fedora",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:python:python:3.11.0:alpha1:*:*:*:*:*:*",
                "cpe:2.3:a:python:python:3.11.0:alpha2:*:*:*:*:*:*",
                "cpe:2.3:a:python:python:3.11.0:alpha3:*:*:*:*:*:*",
                "cpe:2.3:a:python:python:3.11.0:alpha4:*:*:*:*:*:*",
                "cpe:2.3:a:python:python:3.11.0:alpha5:*:*:*:*:*:*",
                "cpe:2.3:a:python:python:3.11.0:alpha6:*:*:*:*:*:*",
                "cpe:2.3:a:python:python:3.11.0:alpha7:*:*:*:*:*:*",
                "cpe:2.3:a:python:python:3.11.0:beta1:*:*:*:*:*:*",
                "cpe:2.3:a:python:python:3.11.0:beta2:*:*:*:*:*:*",
                "cpe:2.3:a:python:python:3.11.0:beta3:*:*:*:*:*:*",
                "cpe:2.3:a:python:python:3.11.0:beta4:*:*:*:*:*:*",
                "cpe:2.3:a:python:python:3.11.0:beta5:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "3.11.0-alpha1"
                },
                {
                    "last_affected": "3.11.0-alpha1"
                },
                {
                    "introduced": "3.11.0-alpha2"
                },
                {
                    "last_affected": "3.11.0-alpha2"
                },
                {
                    "introduced": "3.11.0-alpha3"
                },
                {
                    "last_affected": "3.11.0-alpha3"
                },
                {
                    "introduced": "3.11.0-alpha4"
                },
                {
                    "last_affected": "3.11.0-alpha4"
                },
                {
                    "introduced": "3.11.0-alpha5"
                },
                {
                    "last_affected": "3.11.0-alpha5"
                },
                {
                    "introduced": "3.11.0-alpha6"
                },
                {
                    "last_affected": "3.11.0-alpha6"
                },
                {
                    "introduced": "3.11.0-alpha7"
                },
                {
                    "last_affected": "3.11.0-alpha7"
                },
                {
                    "introduced": "3.11.0-beta1"
                },
                {
                    "last_affected": "3.11.0-beta1"
                },
                {
                    "introduced": "3.11.0-beta2"
                },
                {
                    "last_affected": "3.11.0-beta2"
                },
                {
                    "introduced": "3.11.0-beta3"
                },
                {
                    "last_affected": "3.11.0-beta3"
                },
                {
                    "introduced": "3.11.0-beta4"
                },
                {
                    "last_affected": "3.11.0-beta4"
                },
                {
                    "introduced": "3.11.0-beta5"
                },
                {
                    "last_affected": "3.11.0-beta5"
                }
            ],
            "vendor_product": "python:python",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                }
            ],
            "vendor_product": "redhat:enterprise_linux",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "last_affected": "3.0.0"
                }
            ],
            "vendor_product": "redhat:quay",
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/python/cpython

Affected ranges

Type
GIT
Repo
https://github.com/python/cpython
Events
Introduced
1bf9cc509326bc42cd8cb1650eb9bf64550d817e
Fixed
e1ebdc52b8bd82a928398b0a75149552a723389a
Introduced
fa919fdf2583bdfead1df00e842f24f30b2a34bf
Fixed
f43e7678a1443b2583fc9bfba091b8ca7e38f075
Introduced
9cf6752276e6fcfd0c23fdb064ad27f448aaaf75
Fixed
816066f497ab89abcdb3c4f2d34462c750d23713
Introduced
b494f5935c92951e75597bfe1c8b1f3112fec270
Fixed
6cc6b13308b3202270ea7ac0ee776762a66f6a2f
Introduced
41cb07120b7792eac6413b0c56256a25e9b14e5d
Last affected
41cb07120b7792eac6413b0c56256a25e9b14e5d
Database specific 
{
    "extracted_events": [
        {
            "introduced": "3.7.0"
        },
        {
            "fixed": "3.7.14"
        },
        {
            "introduced": "3.8.0"
        },
        {
            "fixed": "3.8.14"
        },
        {
            "introduced": "3.9.0"
        },
        {
            "fixed": "3.9.14"
        },
        {
            "introduced": "3.10.0"
        },
        {
            "fixed": "3.10.7"
        },
        {
            "introduced": "3.11.0-rc1"
        },
        {
            "last_affected": "3.11.0-rc1"
        }
    ],
    "cpe": [
        "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:python:python:3.11.0:rc1:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

3.*
3.11.0-rc1
v3.*
v3.11.0rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10735.json"