CVE-2024-6232

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06	Patch
https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4	Patch
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d
https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877
https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf	Patch
https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373	Patch
https://github.com/python/cpython/issues/121285	Exploit Issue Tracking Patch
https://github.com/python/cpython/pull/121286	Issue Tracking Patch
https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/	Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/09/03/5
https://security.netapp.com/advisory/ntap-20241018-0007/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:python:python::::::::
	cpe:2.3:a:python:python:3.13.0:alpha0::::::
	cpe:2.3:a:python:python:3.13.0:alpha1::::::
	cpe:2.3:a:python:python:3.13.0:alpha2::::::
	cpe:2.3:a:python:python:3.13.0:alpha3::::::
	cpe:2.3:a:python:python:3.13.0:alpha4::::::
	cpe:2.3:a:python:python:3.13.0:alpha5::::::
	cpe:2.3:a:python:python:3.13.0:alpha6::::::
	cpe:2.3:a:python:python:3.13.0:beta1::::::
	cpe:2.3:a:python:python:3.13.0:beta2::::::
	cpe:2.3:a:python:python:3.13.0:beta3::::::
	cpe:2.3:a:python:python:3.13.0:beta4::::::
	cpe:2.3:a:python:python:3.13.0:rc1::::::

History

21 Nov 2024, 09:49

Type	Values Removed	Values Added
Summary	(es) Existe una vulnerabilidad de gravedad MEDIA que afecta a CPython. Las expresiones regulares que permitían un retroceso excesivo durante el análisis del encabezado tarfile.TarFile son vulnerables a ReDoS a través de archivos tar manipulados específicamente.	(es) Existe una vulnerabilidad de gravedad MEDIA que afecta a CPython. Las expresiones regulares que permitían un retroceso excesivo durante el análisis de cabeceras tarfile.TarFile son vulnerables a ReDoS a través de archivos tar manipulados específicamente.
References		() http://www.openwall.com/lists/oss-security/2024/09/03/5 - () https://security.netapp.com/advisory/ntap-20241018-0007/ -

04 Sep 2024, 21:15

Type	Values Removed	Values Added
References		() https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d - () https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877 -

04 Sep 2024, 15:01

Type	Values Removed	Values Added
References	~~() https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06 -~~	() https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06 - Patch
References	~~() https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4 -~~	() https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4 - Patch
References	~~() https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf -~~	() https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf - Patch
References	~~() https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373 -~~	() https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373 - Patch
References	~~() https://github.com/python/cpython/issues/121285 -~~	() https://github.com/python/cpython/issues/121285 - Exploit, Issue Tracking, Patch
References	~~() https://github.com/python/cpython/pull/121286 -~~	() https://github.com/python/cpython/pull/121286 - Issue Tracking, Patch
References	~~() https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/ -~~	() https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/ - Vendor Advisory
First Time		Python python Python
Summary		(es) Existe una vulnerabilidad de gravedad MEDIA que afecta a CPython. Las expresiones regulares que permitían un retroceso excesivo durante el análisis del encabezado tarfile.TarFile son vulnerables a ReDoS a través de archivos tar manipulados específicamente.
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CPE		cpe:2.3:a:python:python:3.13.0:beta4:::::: cpe:2.3:a:python:python:3.13.0:alpha3:::::: cpe:2.3:a:python:python:3.13.0:alpha2:::::: cpe:2.3:a:python:python:3.13.0:alpha1:::::: cpe:2.3:a:python:python:::::::: cpe:2.3:a:python:python:3.13.0:alpha5:::::: cpe:2.3:a:python:python:3.13.0:alpha6:::::: cpe:2.3:a:python:python:3.13.0:beta2:::::: cpe:2.3:a:python:python:3.13.0:rc1:::::: cpe:2.3:a:python:python:3.13.0:alpha4:::::: cpe:2.3:a:python:python:3.13.0:beta3:::::: cpe:2.3:a:python:python:3.13.0:alpha0:::::: cpe:2.3:a:python:python:3.13.0:beta1::::::

03 Sep 2024, 15:15

Type	Values Removed	Values Added
References		() https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06 - () https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4 - () https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf - () https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373 -

03 Sep 2024, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-03 13:15

Updated : 2024-11-21 09:49

NVD link : CVE-2024-6232

Mitre link : CVE-2024-6232

CVE.ORG link : CVE-2024-6232

JSON object : View

Products Affected

python

python

CWE

CWE-1333

Inefficient Regular Expression Complexity

7.5 /10