CVE-2020-10735

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

This flaw was found in the Python interpreter's algorithms for converting strings to integers in non-binary bases (such as base-10). This algorithmic complexity vulnerability is triggered when an application attempts to parse a string containing an excessive number of digits. This flaw is rated as moderate because the near-quadratic processing time can be exploited to cause a Denial of Service (DoS) by exhausting CPU resources, which impacts the availability of the application process rather than the entire system.

Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Python 2 has been declared end of life and no patches will be made available for it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.