From: Peter Korsgaard <peter@korsgaard.com>
To: buildroot@buildroot.org
References: <20221122201826.49696-1-peter@korsgaard.com>
Date: Wed, 23 Nov 2022 11:03:56 +0100
In-Reply-To: <20221122201826.49696-1-peter@korsgaard.com> (Peter Korsgaard's
 message of "Tue, 22 Nov 2022 21:18:25 +0100")
Message-ID: <87pmde0yyb.fsf@dell.be.48ers.dk>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
MIME-Version: 1.0
Subject: Re: [Buildroot] [PATCH] package/python3: add upstream security fix
 for CVE-2022-45061
Precedence: list
Cc: Asaf Kahlon <asafka7@gmail.com>,
 Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: buildroot-bounces@buildroot.org
Sender: "buildroot" <buildroot-bounces@buildroot.org>

>>>>> "Peter" == Peter Korsgaard <peter@korsgaard.com> writes:

 > Fixes the following security issue:
 > CVE-2022-45061: An issue was discovered in Python before 3.11.1.  An
 > unnecessary quadratic algorithm exists in one path when processing some
 > inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably
 > long name being presented to the decoder could lead to a CPU denial of
 > service.  Hostnames are often supplied by remote servers that could be
 > controlled by a malicious actor; in such a scenario, they could trigger
 > excessive CPU consumption on the client attempting to make use of an
 > attacker-supplied supposed hostname.  For example, the attack payload could
 > be placed in the Location header of an HTTP response with status code 302.

 > Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Committed, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot