CVE - CVE-2024-6232

CVE-ID
CVE-2024-6232	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06 URL:https://github.com/python/cpython/commit/4eaf4891c12589e3c7bdad5f5b076e4c8392dd06 MISC:https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4 URL:https://github.com/python/cpython/commit/743acbe872485dc18df4d8ab2dc7895187f062c4 MISC:https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d URL:https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d MISC:https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877 URL:https://github.com/python/cpython/commit/b4225ca91547aa97ed3aca391614afbb255bc877 MISC:https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf URL:https://github.com/python/cpython/commit/d449caf8a179e3b954268b3a88eb9170be3c8fbf MISC:https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373 URL:https://github.com/python/cpython/commit/ed3a49ea734ada357ff4442996fd4ae71d253373 MISC:https://github.com/python/cpython/issues/121285 URL:https://github.com/python/cpython/issues/121285 MISC:https://github.com/python/cpython/pull/121286 URL:https://github.com/python/cpython/pull/121286 MISC:https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/ URL:https://mail.python.org/archives/list/security-announce@python.org/thread/JRYFTPRHZRTLMZLWQEUHZSJXNHM4ACTY/
Assigning CNA
Python Software Foundation
Date Record Created
20240620	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240620)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)

Use of the CVE® List and the associated references from this website are subject to the terms of use. CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2024, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation.