Incorrect type conversion in python
Priority MEDIUM 40CWE-704Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-704 and the CVSS impact.
Summary
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04538 91st percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 10 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | python | python 3.7 | — | No fix listed | CNA |
- python Vendor— Affected python 3.7 Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | 3.7.0 to before 3.7.14; 3.8.0 to before 3.8.14; 3.9.0 to before 3.9.14; 3.10.0 to before 3.10.7 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:alpha1:*:*:*:*:*:* | 3.11.0 alpha1 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:alpha2:*:*:*:*:*:* | 3.11.0 alpha2 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:alpha3:*:*:*:*:*:* | 3.11.0 alpha3 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:alpha4:*:*:*:*:*:* | 3.11.0 alpha4 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:alpha5:*:*:*:*:*:* | 3.11.0 alpha5 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:alpha6:*:*:*:*:*:* | 3.11.0 alpha6 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:alpha7:*:*:*:*:*:* | 3.11.0 alpha7 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:beta1:*:*:*:*:*:* | 3.11.0 beta1 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:beta2:*:*:*:*:*:* | 3.11.0 beta2 | Vulnerable | python-pillow |
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions 3.7.0 to before 3.7.14; 3.8.0 to before 3.8.14; 3.9.0 to before 3.9.14; 3.10.0 to before 3.10.7 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:alpha1:*:*:*:*:*:* Versions 3.11.0 alpha1 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:alpha2:*:*:*:*:*:* Versions 3.11.0 alpha2 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:alpha3:*:*:*:*:*:* Versions 3.11.0 alpha3 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:alpha4:*:*:*:*:*:* Versions 3.11.0 alpha4 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:alpha5:*:*:*:*:*:* Versions 3.11.0 alpha5 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:alpha6:*:*:*:*:*:* Versions 3.11.0 alpha6 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:alpha7:*:*:*:*:*:* Versions 3.11.0 alpha7 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:beta1:*:*:*:*:*:* Versions 3.11.0 beta1 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:beta2:*:*:*:*:*:* Versions 3.11.0 beta2 Vulnerable ·python-pillow
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:3.11.0:beta3:*:*:*:*:*:* | 3.11.0 beta3 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:beta4:*:*:*:*:*:* | 3.11.0 beta4 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:beta5:*:*:*:*:*:* | 3.11.0 beta5 | Vulnerable | python-pillow |
| cpe:2.3:a:python:python:3.11.0:rc1:*:*:*:*:*:* | 3.11.0 rc1 | Vulnerable | python-pillow |
| cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:* | 3.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
- cpe:2.3:a:python:python:3.11.0:beta3:*:*:*:*:*:* Versions 3.11.0 beta3 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:beta4:*:*:*:*:*:* Versions 3.11.0 beta4 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:beta5:*:*:*:*:*:* Versions 3.11.0 beta5 Vulnerable ·python-pillow
- cpe:2.3:a:python:python:3.11.0:rc1:*:*:*:*:*:* Versions 3.11.0 rc1 Vulnerable ·python-pillow
- cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
Remediation
Red Hat 6 advisories
- RHSA-2024:0430 Released 2024-01-25 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) platform-python-3.6.8-47.el8_6.4, platform-python-debug-3.6.8-47.el8_6.4, platform-python-devel-3.6.8-47.el8_6.4 +3
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) platform-python-3.6.8-47.el8_6.4, python3-3.6.8-47.el8_6.4, python3-libs-3.6.8-47.el8_6.4 +1
- RHSA-2023:2763 Released 2023-05-16 · Red Hat rating Moderatepython38:3.8 and python38-devel:3.8 security update
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src::python38:3.8, PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src::python38:3.8, babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src::python38:3.8 +47
- Red Hat Enterprise Linux CRB (v. 8) pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8 +15
- RHSA-2023:2764 Released 2023-05-16 · Red Hat rating Moderatepython39:3.9 and python39-devel:3.9 security update
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.5.0+10613+59a13ec4.src::python39:3.9, mod_wsgi-4.7.1-5.module+el8.7.0+16654+645aad7f.src::python39:3.9, numpy-1.19.4-3.module+el8.5.0+12204+54860423.src::python39:3.9 +47
- Red Hat Enterprise Linux CRB (v. 8) Cython-0.29.21-5.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9, pybind11-2.7.1-1.module+el8.6.0+12838+640e6226.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.4.0+9822+20bf1249.src::python39-devel:3.9 +33
Show 3 more Red Hat advisories
- RHSA-2023:0833 Released 2023-02-21 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-48.el8_7.1, platform-python-debug-3.6.8-48.el8_7.1, platform-python-devel-3.6.8-48.el8_7.1 +3
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-48.el8_7.1, python3-3.6.8-48.el8_7.1, python3-libs-3.6.8-48.el8_7.1 +1
- RHSA-2022:7323 Released 2022-11-02 · Red Hat rating Moderatepython3.9 security update
- Red Hat CodeReady Linux Builder (v. 9) python3-3.9.10-3.el9_0, python3-debug-3.9.10-3.el9_0, python3-idle-3.9.10-3.el9_0 +2
- Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.10-3.el9_0, python3-devel-3.9.10-3.el9_0, python3-tkinter-3.9.10-3.el9_0
- Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.10-3.el9_0, python3-libs-3.9.10-3.el9_0, python3.9-3.9.10-3.el9_0
- RHSA-2022:6766 Released 2022-10-03 · Red Hat rating Moderaterh-python38-python security update
- Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python-3.8.14-1.el7, rh-python38-python-debug-3.8.14-1.el7, rh-python38-python-devel-3.8.14-1.el7 +6
- Red Hat Software Collections for RHEL(v. 7) rh-python38-python-3.8.14-1.el7, rh-python38-python-debug-3.8.14-1.el7, rh-python38-python-devel-3.8.14-1.el7 +6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2022:7323 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2023:0833, RHSA-2023:2763, RHSA-2023:2764 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:7323 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2024:0430 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2023:0833 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2022:7323 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2024:0430 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2023:2763, RHSA-2023:2764 |
| Red Hat Software Collections for RHEL Workstation(v. 7) | Fixed | RHSA-2022:6766 |
| Red Hat Software Collections for RHEL(v. 7) | Fixed | RHSA-2022:6766 |
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2020-10735
- 2026-10-03 Alias added: GHSA-6jr7-xr67-mgxw
- 2026-10-07 CVSS score added · CISA ADP
- 2026-10-07 Weakness changed · CISA ADP
- 2026-10-07 CISA SSVC decision points changed
References
Advisory 25
- https://access.redhat.com/security/cve/CVE-2020-10735
- https://docs.google.com/document/d/1KjuF_aXlzPUxTK4BMgezGJ2Pn7uevfX7g0_mvgHlL7Y
- https://bugzilla.redhat.com/show_bug.cgi?id=1834423
- FEDORA-2022-46a44a7f83
- FEDORA-2022-66b65beccb
- FEDORA-2022-4b31e33ed0
- FEDORA-2022-6d57598a23
- FEDORA-2022-f330bbfda2
- FEDORA-2022-29d436596f
- FEDORA-2022-b01214472e
- FEDORA-2022-dd5032bedf
- FEDORA-2022-8535093cba
- FEDORA-2022-72213986b8
- [oss-security] 20220921 big ints in python: CVE-2020-10735
- [oss-security] 20220921 Re: big ints in python: CVE-2020-10735
- FEDORA-2022-f511f8f58b
- FEDORA-2022-c072cdc3c8
- FEDORA-2022-0b3904c674
- FEDORA-2022-141f632a6f
- FEDORA-2022-ac82a548df
- FEDORA-2022-d4570fc1a6
- FEDORA-2022-b8b34e62ab
- FEDORA-2022-d1682fef04
- FEDORA-2022-79843dfb3c
- FEDORA-2022-958fd7a32e
Sources
- CVE-2020-10735 · CVE Program
- CVE-2020-10735 · NVD
- FIRST EPSS
- GHSA-6jr7-xr67-mgxw · GitHub Advisory Database · CC BY 4.0
- CVE-2020-10735 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences