Denial of Service Vulnerability in Python3 due to Improper Hash Computation
Summary
ALPINE-CVE-2020-14422: Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by t... Affects python3 versions < 3.7.7-r1. Fixed in 3.7.7-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3 is a widely used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is extensively utilized in web development, data analysis, artificial intelligence, and more. The vulnerability in question arises from the 'ipaddress' library, which is responsible for handling IPv4 and IPv6 addresses. This library is crucial for applications that manage network interfaces and IP addresses, making it a critical component for many Python applications.
Vulnerability Detail
The vulnerability, identified as CVE-2020-14422, exists in the 'ipaddress.py' module of Python versions up to 3.8.3. It improperly computes hash values in the IPv4Interface and IPv6Interface classes. This flaw can be exploited by a remote attacker to create numerous dictionary entries containing these objects, potentially leading to a denial of service. The performance degradation caused by this vulnerability can severely impact applications relying on these classes, making them unresponsive or slow.
How To Fix
Minimum fixed version
3.7.7-r1
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the number of dictionary entries created with IPv4Interface and IPv6Interface objects in your application. This can help mitigate the impact of the vulnerability until a proper update is applied.
Conclusion
CVE-2020-14422 is a significant vulnerability in Python's ipaddress module that can lead to denial of service. It is crucial for developers to update their Python installations to the patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python3 →
FAQ
CVE-2020-14422 is a vulnerability in Python's ipaddress module that can lead to denial of service due to improper hash computation.
If your application uses IPv4Interface or IPv6Interface objects, it may become unresponsive if an attacker exploits this vulnerability.
Python versions up to 3.8.3 are affected by this vulnerability. Versions 3.8.4 and later contain the necessary fixes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without signup.
The CVSS score of CVE-2020-14422 is 5.9, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
