languages/cpython
languages/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython synced 2024-07-20 17:55:24 +00:00
Code Issues Actions 8 Packages Projects Releases Wiki Activity

gh-95913: Forward-port int/str security change to 3.11 What's New in main (#98344)

Browse source 
Add int/str security change from issue gh-95778 PRs gh-96499 / gh-95800

Co-authored-by: Gregory P. Smith <greg@krypto.org> [Google]
This commit is contained in:
C.A.M. Gerlach 2022-10-16 20:43:13 -05:00 committed by GitHub
parent ae19217867
commit bb38b39b33
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
Doc/whatsnew/3.11.rst
View file

@ -530,6 +530,17 @@ Other CPython Implementation Changes
and with the new :option:`--help-all`.
(Contributed by Éric Araujo in :issue:`46142`.)
* Converting between :class:`int` and :class:`str` in bases other than 2
(binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal)
now raises a :exc:`ValueError` if the number of digits in string form is
above a limit to avoid potential denial of service attacks due to the
algorithmic complexity. This is a mitigation for `CVE-2020-10735
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10735>`_.
This limit can be configured or disabled by environment variable, command
line flag, or :mod:`sys` APIs. See the :ref:`integer string conversion
length limitation <int_max_str_digits>` documentation. The default limit
is 4300 digits in string form.
.. _whatsnew311-new-modules: