diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2022-11-08 03:23:16 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-11-08 03:23:16 (GMT) |
| commit | 9bb8e18ca46fe66fa6802602f8a7228a24dd785f (patch) | |
| tree | c7ed7974ccebac67643169a50e22887e94eb0244 /Misc/NEWS.d | |
| parent | e7781fd695c0ee44904f717eb0511cbf00b22090 (diff) | |
| download | cpython-9bb8e18ca46fe66fa6802602f8a7228a24dd785f.zip cpython-9bb8e18ca46fe66fa6802602f8a7228a24dd785f.tar.gz cpython-9bb8e18ca46fe66fa6802602f8a7228a24dd785f.tar.bz2 | |
[3.11] gh-98433: Fix quadratic time idna decoding. (GH-99092) (GH-99222)
There was an unnecessary quadratic loop in idna decoding. This restores
the behavior to linear.
(cherry picked from commit d315722564927c7202dd6e111dc79eaf14240b0d)
(cherry picked from commit a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15)
Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Diffstat (limited to 'Misc/NEWS.d')
| -rw-r--r-- | Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst b/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst new file mode 100644 index 0000000..5185fac --- /dev/null +++ b/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst @@ -0,0 +1,6 @@ +The IDNA codec decoder used on DNS hostnames by :mod:`socket` or :mod:`asyncio` +related name resolution functions no longer involves a quadratic algorithm. +This prevents a potential CPU denial of service if an out-of-spec excessive +length hostname involving bidirectional characters were decoded. Some protocols +such as :mod:`urllib` http ``3xx`` redirects potentially allow for an attacker +to supply such a name. |