NotificationsYou must be signed in to change notification settings
Fork32.1k
Star67.3k

[3.8] gh-98433: Fix quadratic time idna decoding. (GH-99092) (GH-99222)#99231

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

ambv merged 1 commit intopython:3.8frommiss-islington:backport-a6f6c3a-3.8

Nov 10, 2022

Merged

[3.8] gh-98433: Fix quadratic time idna decoding. (GH-99092) (GH-99222)#99231

ambv merged 1 commit intopython:3.8frommiss-islington:backport-a6f6c3a-3.8

Nov 10, 2022

Conversation

Copy link

Contributor

miss-islington commentedNov 8, 2022•
edited by bedevere-bot
Loading

There was an unnecessary quadratic loop in idna decoding. This restores
the behavior to linear.

(cherry picked from commitd315722)

(cherry picked from commita6f6c3a)

Co-authored-by: Miss Islington (bot)31488909+miss-islington@users.noreply.github.com
Co-authored-by: Gregory P. Smithgreg@krypto.org

Issue:Slow IDNA decoding with large strings [CVE-2022-45061] #98433

[3.11]pythongh-98433: Fix quadratic time idna decoding. (pythonGH-99092

064ec20

) (pythonGH-99222)There was an unnecessary quadratic loop in idna decoding. This restoresthe behavior to linear.(cherry picked from commitd315722)(cherry picked from commita6f6c3a)Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>

bedevere-bot mentioned this pull request

Nov 8, 2022

Slow IDNA decoding with large strings [CVE-2022-45061]#98433

Closed

bedevere-bot added the awaiting review label

Nov 8, 2022

bedevere-bot mentioned this pull request

Nov 8, 2022

[3.11] gh-98433: Fix quadratic time idna decoding. (GH-99092)#99222

Merged

bedevere-bot added type-bug

An unexpected behavior, bug, or error

type-securityA security issue labels

Nov 8, 2022

gpshead changed the title~~[3.8] [3.11] gh-98433: Fix quadratic time idna decoding. (GH-99092) (GH-99222)~~[3.8] gh-98433: Fix quadratic time idna decoding. (GH-99092) (GH-99222)

Nov 8, 2022

gpshead added the release-blocker label

Nov 8, 2022

gpshead approved these changes

Nov 8, 2022

View reviewed changes

bedevere-bot added awaiting merge and removed awaiting review labels

Nov 8, 2022

gpshead assignedambv

Nov 8, 2022

Copy link

ContributorAuthor

miss-islington commentedNov 8, 2022

Sorry, I can't merge this PR. Reason:You're not authorized to push to this branch. Visit https://docs.github.com/articles/about-protected-branches/ for more information..

vstinner approved these changes

Nov 9, 2022

View reviewed changes

Copy link

Member

vstinner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

LGTM, good bot.

Copy link

Member

vstinner commentedNov 9, 2022

@ambv: Would you mind to merge this security fix? It's already in other branches, including 3.7 ;-)

ambv merged commit82ca283 intopython:3.8

Nov 10, 2022

bedevere-bot removed the awaiting merge label

Nov 10, 2022

miss-islington deleted the backport-a6f6c3a-3.8 branch

November 10, 2022 15:56

Copy link

Contributor

ngie-eign commentedNov 15, 2022•
edited
Loading

@ambv : is there a plan for when the next 3.8 release might be cut? I noticed that this item wasn't in .15; Blackduck is already citing this as an issue, so the need for resolving this in cpython and trickling the fix down will need to come sooner rather than later.