Performance Degradation Vulnerability in Python Packages: CVE-2020-10735
Summary
UBUNTU-CVE-2020-10735: A flaw was found in python. Affects python2.7 versions 2.7.5-8ubuntu3 – 2.7.6-8ubuntu0.6+esm9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is utilized in various applications, from web development to data analysis. The vulnerability CVE-2020-10735 affects Python versions 2.7, 3.4, 3.5, and others, specifically in the context of parsing large integer strings, which can lead to significant performance degradation.
Vulnerability Detail
CVE-2020-10735 is a vulnerability found in Python's integer parsing algorithms. When using non-binary bases, the int() function can exhibit quadratic time complexity, causing severe delays when parsing large integer strings. For instance, parsing a string with 100,000 digits can take approximately 50 milliseconds, while a string with 1,000,000 digits may take up to 5 seconds. This vulnerability poses a risk to system availability, as applications relying on Python for processing large integers may experience significant slowdowns or become unresponsive.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the int() function with large non-binary integer strings. Instead, consider using alternative methods for handling large numbers, such as breaking them into smaller chunks or using libraries designed for high-performance numerical computations.
Conclusion
CVE-2020-10735 is a critical vulnerability affecting various Python packages, leading to performance issues when parsing large integer strings. It is essential to update affected packages and consider workarounds to ensure system stability and performance.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2020-10735 is a vulnerability in Python's integer parsing that can lead to performance degradation when processing large integer strings.
The vulnerability affects Python versions 2.7, 3.4, 3.5, and others in the Ubuntu ecosystem.
The vulnerability can cause significant slowdowns in applications that rely on Python for processing large integers, potentially leading to system unavailability.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. Simply upload your manifest file, such as package-lock.json, to check for vulnerabilities.
Update your Python packages to the latest patched versions and consider implementing workarounds to avoid using the int() function with large non-binary integer strings.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
