CVE-2020-14422 — Use of Insufficiently Random Values in Python

CWE-330 — Use of Insufficiently Random ValuesCWE-682 — Incorrect CalculationCWE-400 — Uncontrolled Resource Consumption25 documents9 sources
Severity
5.9MEDIUMNVD
EPSS
1.2%
top 21.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
PythonFedoraproject FedoraOpensuse Leap+1 more
Timeline
PublishedJun 18
Latest updateJul 11

Description

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.2 | Impact: 3.6

Affected Packages3 packages

▶NVDpython/python3.0.0 — 3.5.10+3
▶NVDopensuse/leap15.1, 15.2+1

Also affects: Fedora 31, 32

🔴Vulnerability Details

3
GHSA
Incorrect Calculation and Use of Insufficiently Random Values in Python↗2021-05-11
▶
CVEList
CVE-2020-14422: Lib/ipaddress↗2020-06-18
▶
OSV
CVE-2020-14422: Lib/ipaddress↗2020-06-18
▶

📋Vendor Advisories

5
Ubuntu
Python vulnerabilities↗2024-07-11
▶
Ubuntu
Python vulnerabilities↗2020-07-22
▶
Red Hat
python: DoS via inefficiency in IPv{4,6}Interface classes↗2020-06-18
▶
Microsoft
Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes which might allow a remote attacker to cause a denial of service if an applicati↗2020-06-09
▶
Debian
CVE-2020-14422: python-ipaddress - Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the ...↗2020
▶

💬Community

16
Bugzilla
CVE-2020-14422 python-pip: python: DoS via inefficiency in IPv{4,6}Interface classes [epel-all]↗2020-07-15
▶
Bugzilla
CVE-2020-14422 python-pip: python: DoS via inefficiency in IPv{4,6}Interface classes [fedora-all]↗2020-07-15
▶
Bugzilla
CVE-2020-14422 python-ipaddress: python: DoS via inefficiency in IPv{4,6}Interface classes↗2020-07-15
▶
Bugzilla
CVE-2020-14422 mingw-python3: python: DoS via inefficiency in IPv{4,6}Interface classes [fedora-all]↗2020-07-08
▶
Bugzilla
CVE-2020-14422 python34: python: Denial of service via inefficiency in IPv{4,6}Interface classes [fedora-all]↗2020-07-08
▶