GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.10] gh-95778: CVE-2020-10735: Prevent DoS by very large int() by gpshead · Pull Request #96501 · python/cpython

Conversation

@gpshead

@gpshead gpshead commented Sep 2, 2022 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Integer to and from text conversions via CPython's bignum int type is not safe against denial of service attacks due to malicious input. Very large input strings with hundred thousands of digits can consume several CPU seconds.

This PR comes fresh from a pile of work done in our private PSRT security response team repo.

This backports #96499 aka 511ca94

Signed-off-by: Christian Heimes [Red Hat] [email protected]
Tons-of-polishing-up-by: Gregory P. Smith [Google] [email protected]
Reviews via the private PSRT repo via many others (see the NEWS entry in the PR).

  • Issue: CVE-2020-10735: Prevent DoS by large int<->str conversions #95778

I wrote up a one pager for the release managers.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
gpshead and others added 8 commits August 19, 2022 00:32
@gpshead
Backport to 3.10 from CVE-2020-10735-3.11backport.
4631817
@gpshead
doc patch fixup & missing help text blank line.
0e84c7e
@gpshead @tiran
Update attribution in Misc/NEWS.d
7a19c64 
Co-authored-by: Christian Heimes <[email protected]>
@tiran
Manually add new field to abi file
fe60b07
@gpshead
Move the whatsnew text per review.
5e1ba25 
Ned pointed this out on the 3.7 review, it matches other patch
changes and stands out better.
@gpshead
Merge branch 'CVE-2020-10735-3.10backport' of github.com:python/psrt …
bcd2ab0 
…into CVE-2020-10735-3.10backport
@gpshead
Make the doctest actually run & fix it.
97b157d
@gpshead
Fix the docs build.
adab0bf
@gpshead gpshead assigned gpshead and pablogsal Sep 2, 2022
@bedevere-bot bedevere-bot added the awaiting core review label Sep 2, 2022
@gpshead
Rename the news file to appease the Bedevere bot.
059f402
@gpshead gpshead added the release-blocker label Sep 2, 2022
@gpshead
Merge branch '3.10' into CVE-2020-10735-3.10backport
4d1f053
@gpshead
gpshead marked this pull request as ready for review September 2, 2022 05:57
@gpshead
gpshead requested review from lysnikolaou, pablogsal, rhettinger and terryjreedy as code owners September 2, 2022 05:57
@tiran tiran added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Sep 2, 2022
@bedevere-bot

bedevere-bot commented Sep 2, 2022

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @tiran for commit 4d1f053 🤖

If you want to schedule another build, you need to add the ":hammer: test-with-buildbots" label again.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Sep 2, 2022
@gpshead
hexadecimal spelling =)
35c2d42
@gpshead
gpshead merged commit 8f0fa4b into python:3.10 Sep 2, 2022
@bedevere-bot bedevere-bot removed the awaiting core review label Sep 2, 2022
@gpshead

gpshead commented Sep 4, 2022

Copy link
Copy Markdown
Member Author

bugfix incoming #96537
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@terryjreedy terryjreedy Awaiting requested review from terryjreedy terryjreedy is a code owner
@rhettinger rhettinger Awaiting requested review from rhettinger rhettinger is a code owner
@pablogsal pablogsal Awaiting requested review from pablogsal pablogsal is a code owner
@lysnikolaou lysnikolaou Awaiting requested review from lysnikolaou lysnikolaou is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

@pablogsal pablogsal

Labels

release-blocker

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@gpshead @bedevere-bot @tiran @pablogsal
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.