CVE-2022-48566

A constant-time-defeating optimization issue was found in python. This issue occurs when sending a specially crafted request, which could allow an attacker to obtain sensitive information.

This flaw is classified as Moderate as in contrast to an Important rating, the exploitation of this vulnerability is difficult to achieve and the outcome of the impact is breach of confidentiality.

Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the interpreter of the Python programming language.

Versions of python39:3.9/python39 and python2 in various modules as shipped with Red Hat Enterprise Linux 8, python3.11/python3.9 as shipped with Red Hat Enterprise Linux 9 and python 3.8.14 as shipped with Red Hat Software Collections are marked as 'Not affected' as they are higher than the vulnerable version, thereby containing the fixed code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

As per upstream, either make the accumulator variable result a volatile unsigned char instead of unsigned char or use instead use CRYPTO_memcmp from OpenSSL/BoringSSL when SSL is available as SSL libraries are more secure when it comes to timing based vulnerabilities.

https://github.com/python/cpython/issues/84968