Vulnerability · Published Jun 18, 2020 · Assigned by mitre

CVE-2020-14422

Medium 5.9

In plain English

A medium-severity security flaw in the python38-Cython package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.7% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.9Medium

Exploit odds (30 days)12.7%top 3.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	python38-Cython	0.29.14-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-asn1crypto	1.2.0-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-cffi	1.13.2-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-chardet	3.0.4-19.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-cryptography	2.8-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-idna	2.8-6.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-markupsafe	1.1.1-6.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-mod_wsgi	4.6.8-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-psycopg2	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-psycopg2-doc	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-psycopg2-tests	2.8.4-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-pycparser	2.19-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-pysocks	1.7.1-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-pytz	2019.3-3.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-requests	2.22.0-9.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
AlmaLinux:8	python38-scipy	1.3.1-4.module_el8.6.0+2778+cd494b30	ALSA-2020:4641
Alpine:v3.20	python3	3.8.4-r0	ALPINE-CVE-2020-14422
Alpine:v3.21	python3	3.8.4-r0	ALPINE-CVE-2020-14422
Alpine:v3.22	python3	3.8.4-r0	ALPINE-CVE-2020-14422
Alpine:v3.23	python3	3.8.4-r0	ALPINE-CVE-2020-14422
Alpine:v3.24	python3	3.8.4-r0	ALPINE-CVE-2020-14422
Rocky Linux:8	Cython	0:0.29.14-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	PyYAML	0:5.3.1-1.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	babel	0:2.7.0-10.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	mod_wsgi	0:4.6.8-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	numpy	0:1.17.3-5.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-asn1crypto	0:1.2.0-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-cffi	0:1.13.2-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-chardet	0:3.0.4-19.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-cryptography	0:2.8-3.module+el8.5.0+672+ab6eb015	RLSA-2020:4641
Rocky Linux:8	python-cryptography	0:2.8-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-idna	0:2.8-6.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-jinja2	0:2.10.3-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-markupsafe	0:1.1.1-6.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-psutil	0:5.6.4-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-psycopg2	0:2.8.4-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-psycopg2	0:2.8.4-4.module+el8.6.0+794+eba84017	RLSA-2020:4641
Rocky Linux:8	python-pycparser	0:2.19-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-pysocks	0:1.7.1-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-requests	0:2.22.0-9.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-urllib3	0:1.25.7-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python-wheel	0:0.33.6-5.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python3x-pip	0:19.3.1-1.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	python3x-setuptools	0:41.6.0-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	pytz	0:2019.3-3.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	scipy	0:1.3.1-4.module+el8.4.0+570+c2eaf144	RLSA-2020:4641
Rocky Linux:8	scipy	0:1.3.1-4.module+el8.5.0+672+ab6eb015	RLSA-2020:4641
Ubuntu:22.04:LTS	python3.10	3.10.12-1~22.04.4	USN-6891-1

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.python.org/issue41004
https://github.com/python/cpython/pull/20956
openSUSE-SU-2020:0931 vendor-advisory
openSUSE-SU-2020:0940 vendor-advisory
[debian-lts-announce] 20200715 [SECURITY] [DLA 2280-1] python3.5 security update mailing-list
FEDORA-2020-b513391ca8 vendor-advisory
FEDORA-2020-705c6ea5be vendor-advisory
openSUSE-SU-2020:0989 vendor-advisory
openSUSE-SU-2020:1002 vendor-advisory
FEDORA-2020-dfb11916cc vendor-advisory
USN-4428-1 vendor-advisory
FEDORA-2020-c3b07cc5c9 vendor-advisory
FEDORA-2020-bb919e575e vendor-advisory
GLSA-202008-01 vendor-advisory
FEDORA-2020-1ddd5273d6 vendor-advisory
FEDORA-2020-87c0a0a52d vendor-advisory
FEDORA-2020-efb908b6a8 vendor-advisory
FEDORA-2020-d808fdd597 vendor-advisory
FEDORA-2020-982b2950db vendor-advisory
FEDORA-2020-c539babb0a vendor-advisory
FEDORA-2020-d30881c970 vendor-advisory
https://www.oracle.com/security-alerts/cpujan2021.html
https://security.netapp.com/advisory/ntap-20200724-0004/
[debian-lts-announce] 20230515 [SECURITY] [DLA 3424-1] python-ipaddress security update mailing-list
https://cert-portal.siemens.com/productcert/html/ssa-398330.html