Detections
Analytics
Alpine: multiple pyc packages, multiple python3 packages: security update to 3.11.1-r0
high Tenable Cloud Security Plugin ID 424413
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path
when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name
being presented to the decoder could lead to a CPU denial of service. Hostnames are often supplied by
remote servers that could be controlled by a malicious actor; in such a scenario, they could trigger
excessive CPU consumption on the client attempting to make use of an attacker-supplied supposed hostname.
For example, the attack payload could be placed in the Location header of an HTTP response with status
code 302. A fix is planned in 3.11.1, 3.10.9, 3.9.16, 3.8.16, and 3.7.16. (CVE-2022-45061)
See Also
Plugin Details
Severity: High
ID: 424413
Version: Revision 1.9
Type: Local
Published: 4/4/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 95.09
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2022-45061
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 11/8/2022
Reference Information
CVE: CVE-2022-45061
IAVA: 2022-A-0467-S, 2023-A-0061-S