IBME22A598C8E55349FC510AA7223D28F3EDB6DEC3CB23F4E97C31A26E009A6BB4CSecurity Bulletin: Data Privacy on Cloud Pak for Data is Vulnerable to Python DoS error (CVE-2022-45061)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.008 Low
EPSS
Percentile
81.5%
Summary
Python denial of service vulnerability is addressed.
Vulnerability Details
CVEID:CVE-2022-45061
**DESCRIPTION:**Python is vulnerable to a denial of service, caused by an unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder. By sending a specially-crafted input, a remote attacker could exploit this vulnerability to cause a CPU denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/240593 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| Data Privacy on Cloud Pak for Data | 4.6.0 |
Remediation/Fixes
CVE-2022-45061 is fixed with Python 3.9.16 in Data Privacy on Cloud Pak for Data in v4.7.0 release
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm cloud pak for data | eq | 4.6.0 |
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.008 Low
EPSS
Percentile
81.5%