CVE-2020-10735

Description

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

How to fix CVE-2020-10735

To remediate CVE-2020-10735, upgrade the affected package to a fixed version below.

—upgrade to 3.7.14 or later
—upgrade to 3.7.14 or later
—upgrade to 3.7.14 or later
—upgrade to 7.3.5+dfsg-2+deb11u4 or later
—upgrade to 7.3.5+dfsg-2+deb11u4 or later
—no fix listed
—upgrade to 3.11.0~rc2-1 or later
—upgrade to 3.9.2-1+deb11u2 or later

Is CVE-2020-10735 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (8)

>= 3.7.0, < 3.7.14, >= 3.8.0, < 3.8.14, >= 3.9.0, < 3.9.14, >= 3.10.0, < 3.10.7
>= 3.7.0, < 3.7.14, >= 3.8.0, < 3.8.14, >= 3.9.0, < 3.9.14, >= 3.10.0, < 3.10.7
>= 3.7.0, < 3.7.14, >= 3.8.0, < 3.8.14, >= 3.9.0, < 3.9.14, >= 3.10.0, < 3.10.7
from 0, < 7.3.5+dfsg-2+deb11u4
from 0, < 7.3.5+dfsg-2+deb11u4
from 0
from 0, < 3.11.0~rc2-1
from 0, < 3.9.2-1+deb11u2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H