Back

CVE-2024-6232

Sept. 3, 2024, 3:15 p.m.

Undergoing Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

CPython

Source

cna@python.org

Tags

cna@python.org
CWE-1333
2024-09-03
CVE-2024-6232

CVE-2024-6232 details

Published : Sept. 3, 2024, 1:15 p.m.
Last Modified : Sept. 3, 2024, 3:15 p.m.

Description

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

CVSS Score

1 2 3 4 5 6 7 8 9 10

Weakness

Weakness Name Description
CWE-1333 Inefficient Regular Expression Complexity The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

URL Source
https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06 cna@python.org
https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4 cna@python.org
https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf cna@python.org
https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373 cna@python.org
https://github.com/python/cpython/issues/121285 cna@python.org
https://github.com/python/cpython/pull/121286 cna@python.org
https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/ cna@python.org
This website uses the NVD API, but is not approved or certified by it.