diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2022-11-10 15:57:41 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-11-10 15:57:41 (GMT) |
| commit | c09dba57cfbbf74273ce44b1f48f71b46806605c (patch) | |
| tree | ff19ab0812ea77de71e7ffafb6578ce4c0f95c04 /Misc | |
| parent | b43496c01a554cf41ae654a0379efae18609ad39 (diff) | |
| download | cpython-c09dba57cfbbf74273ce44b1f48f71b46806605c.zip cpython-c09dba57cfbbf74273ce44b1f48f71b46806605c.tar.gz cpython-c09dba57cfbbf74273ce44b1f48f71b46806605c.tar.bz2 | |
[3.9] gh-98433: Fix quadratic time idna decoding. (GH-99092) (GH-99222) (#99230)
There was an unnecessary quadratic loop in idna decoding. This restores
the behavior to linear.
(cherry picked from commit d315722564927c7202dd6e111dc79eaf14240b0d)
(cherry picked from commit a6f6c3a3d6f2b580f2d87885c9b8a9350ad7bf15)
Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Diffstat (limited to 'Misc')
| -rw-r--r-- | Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst b/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst new file mode 100644 index 0000000..5185fac --- /dev/null +++ b/Misc/NEWS.d/next/Security/2022-11-04-09-29-36.gh-issue-98433.l76c5G.rst @@ -0,0 +1,6 @@ +The IDNA codec decoder used on DNS hostnames by :mod:`socket` or :mod:`asyncio` +related name resolution functions no longer involves a quadratic algorithm. +This prevents a potential CPU denial of service if an out-of-spec excessive +length hostname involving bidirectional characters were decoded. Some protocols +such as :mod:`urllib` http ``3xx`` redirects potentially allow for an attacker +to supply such a name. |