Improper Hash Calculation in Python's IP Addressing Classes
CVE-2020-14422

5.9MEDIUM

Key Information:

Vendor

Opensuse
Status
Leap
Python
Vendor
CVE Published:
18 June 2020

What is CVE-2020-14422?

A vulnerability exists in Python's lib/ipaddress.py where the hash values for IPv4Interface and IPv6Interface classes are computed incorrectly. This miscalculation can be exploited by a remote attacker to create a denial of service, particularly affecting applications that rely on dictionaries containing IPv4Interface or IPv6Interface objects. By crafting many dictionary entries, an attacker can significantly degrade application performance. The issue has been addressed in several updated versions: 3.5.10, 3.6.12, 3.7.9, 3.8.4, 3.8.5, 3.8.6, and 3.9.0.

References

https://bugs.python.org/issue41004
https://github.com/python/cpython/pull/20956
http://lists.opensuse.org/opensuse-security-announce/2020...
vendor-advisory

EPSS Score

12% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.