From 12c527332056107fd5dc4f927279b4ba5af16fcb Mon Sep 17 00:00:00 2001 From: "C.A.M. Gerlach" Date: Sun, 16 Oct 2022 17:30:10 -0500 Subject: [PATCH] Add int/str security change from issue gh-95778 PRs gh-96499 / gh-95800 Co-authored-by: Gregory P. Smith --- Doc/whatsnew/3.11.rst | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/Doc/whatsnew/3.11.rst b/Doc/whatsnew/3.11.rst index 56a35f4e4802ba..73e23a1a9e7f95 100644 --- a/Doc/whatsnew/3.11.rst +++ b/Doc/whatsnew/3.11.rst @@ -530,6 +530,17 @@ Other CPython Implementation Changes and with the new :option:`--help-all`. (Contributed by Éric Araujo in :issue:`46142`.) +* Converting between :class:`int` and :class:`str` in bases other than 2 + (binary), 4, 8 (octal), 16 (hexadecimal), or 32 such as base 10 (decimal) + now raises a :exc:`ValueError` if the number of digits in string form is + above a limit to avoid potential denial of service attacks due to the + algorithmic complexity. This is a mitigation for `CVE-2020-10735 + `_. + This limit can be configured or disabled by environment variable, command + line flag, or :mod:`sys` APIs. See the :ref:`integer string conversion + length limitation ` documentation. The default limit + is 4300 digits in string form. + .. _whatsnew311-new-modules: