.. _slow-idna-large-strings:

Slow IDNA decoding with large strings
=====================================

.. warning::
    This resource is maintained for historical reference and **does not contain the latest vulnerability info for Python**.

    The `canonical database for vulnerabilities affecting Python <https://github.com/psf/advisory-database>`_ is available on GitHub
    in the Open Source Vulnerability (OSV) format. This vulnerability can be viewed online at the
    `Open Source Vulnerability Database <https://osv.dev/list?ecosystem=&q=CVE-2022-45061>`_.

IDNA decoding execution time is not linear in relation to the input string
size, which can cause slowness with large inputs:

* 10 chars = 0.016 seconds
* 100 chars = 0.047 seconds
* 1000 chars = 2.883 seconds
* 2500 chars = 17.724 seconds
* 5000 chars = 1 min 10 seconds

According to `Unicode Technical Standard #46
<https://unicode.org/reports/tr46/>`_, an IDNA label must not be longer
than 63 characters. The Python ``idna`` module enforces the restriction,
but too late.

Dates:

* Disclosure date: **2022-10-19** (Python issue gh-98433 reported)
* Reported at: 2022-09-09 (email to PSRT)
* Reported by: Guido Vranken

Fixed In
--------

* Python **3.7.16** (2022-12-06) fixed by `commit b0b590b (branch 3.7) <https://github.com/python/cpython/commit/b0b590be9597fd5919228d251812dd54145f70a7>`_ (2022-11-08)
* Python **3.8.16** (2022-12-06) fixed by `commit 82ca283 (branch 3.8) <https://github.com/python/cpython/commit/82ca2839c9ec6bf9a9400e791a52411824df67f3>`_ (2022-11-10)
* Python **3.9.16** (2022-12-06) fixed by `commit c09dba5 (branch 3.9) <https://github.com/python/cpython/commit/c09dba57cfbbf74273ce44b1f48f71b46806605c>`_ (2022-11-10)
* Python **3.10.9** (2022-12-06) fixed by `commit 9bb8e18 (branch 3.10) <https://github.com/python/cpython/commit/9bb8e18ca46fe66fa6802602f8a7228a24dd785f>`_ (2022-11-08)
* Python **3.11.1** (2022-12-06) fixed by `commit a6f6c3a (branch 3.11) <https://github.com/python/cpython/commit/a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15>`_ (2022-11-08)

Python issue
------------

Slow IDNA decoding with large strings [CVE-2022-45061].

* Python issue: `gh-98433 <https://github.com/python/cpython/issues/98433>`_
* Creation date: 2022-10-19
* Reporter: guidovranken

CVE-2022-45061
--------------

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname. For example, the attack payload could be placed in the Location header of an HTTP response with status code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16.

* CVE ID: `CVE-2022-45061 <https://nvd.nist.gov/vuln/detail/CVE-2022-45061/>`_
* Published: 2022-11-09

Timeline
--------

Timeline using the disclosure date **2022-10-19** as reference:

* 2022-09-09 (**-40 days**): Reported (email to PSRT)
* 2022-10-19: `Python issue gh-98433 <https://github.com/python/cpython/issues/98433>`_ reported by guidovranken
* 2022-11-08 (**+20 days**): `commit d315722 (branch 3.12) <https://github.com/python/cpython/commit/d315722564927c7202dd6e111dc79eaf14240b0d>`_
* 2022-11-08 (**+20 days**): `commit 9bb8e18 (branch 3.10) <https://github.com/python/cpython/commit/9bb8e18ca46fe66fa6802602f8a7228a24dd785f>`_
* 2022-11-08 (**+20 days**): `commit a6f6c3a (branch 3.11) <https://github.com/python/cpython/commit/a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15>`_
* 2022-11-08 (**+20 days**): `commit b0b590b (branch 3.7) <https://github.com/python/cpython/commit/b0b590be9597fd5919228d251812dd54145f70a7>`_
* 2022-11-09 (**+21 days**): CVE-2022-45061 published
* 2022-11-10 (**+22 days**): `commit 82ca283 (branch 3.8) <https://github.com/python/cpython/commit/82ca2839c9ec6bf9a9400e791a52411824df67f3>`_
* 2022-11-10 (**+22 days**): `commit c09dba5 (branch 3.9) <https://github.com/python/cpython/commit/c09dba57cfbbf74273ce44b1f48f71b46806605c>`_
* 2022-12-06 (**+48 days**): Python 3.10.9 released
* 2022-12-06 (**+48 days**): Python 3.11.1 released
* 2022-12-06 (**+48 days**): Python 3.7.16 released
* 2022-12-06 (**+48 days**): Python 3.8.16 released
* 2022-12-06 (**+48 days**): Python 3.9.16 released