CVE-2020-10735

Published: 9 September 2022

A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.

From the Ubuntu Security Team

To avoid backwards-incompatible changes Ubuntu Security will not apply Python’s CVE-2020-10735 bugfix. Ubuntu Security does not consider int<->str conversion a security issue in Python. Rather, developers may introduce Denial of Service (DoS) vulnerabilities into their code by parsing unsanitized data with int<->str conversion. Developers using bignum integers are encouraged to consider specialized libraries, such as GMP. Using PyLong_FromString() in public APIs without an integer limit is strongly discouraged.

Notes

The upstream patch for this issue now limits the input string for int() to 5000 digits - this is a breaking change but very unlikely to cause a regression since it is highly unlikely there is code handling such large numbers since as noted in the upstream commit, "total amount of protons in the observable universe is known as Eddington number. That number has 80 digits." - so 5000 digits out to be enough for anyone

ongoing discourse on https://discuss.python.org
LWN reports patch causes regressions

Status

Severity score breakdown

References

• https://github.com/python/cpython/pull/96499
• https://discuss.python.org/t/int-str-conversions-broken-in-latest-python-bugfix-releases/18889
• https://lwn.net/Articles/907572/
• https://seclists.org/oss-sec/2022/q3/215
• https://github.com/python/cpython/issues/96834
• https://www.cve.org/CVERecord?id=CVE-2020-10735
• NVD
• Launchpad
• Debian

Bugs

• https://github.com/python/cpython/issues/95778