Lucene search

PSFCVE-2024-6232

HistorySep 03, 2024 - 1:15 p.m.

CVE-2024-6232

2024-09-0313:15:05

CWE-1333

PSF

web.nvd.nist.gov

cpython

vulnerability

tarfile

header parsing

redos

tar archives.

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

44.5%

JSON

There is a MEDIUM severity vulnerability affecting CPython.

Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

Affected configurations

Nvd

Node

pythonpythonRange≤3.12.5

pythonpythonMatch3.13.0alpha0

pythonpythonMatch3.13.0alpha1

pythonpythonMatch3.13.0alpha2

pythonpythonMatch3.13.0alpha3

pythonpythonMatch3.13.0alpha4

pythonpythonMatch3.13.0alpha5

pythonpythonMatch3.13.0alpha6

pythonpythonMatch3.13.0beta1

pythonpythonMatch3.13.0beta2

pythonpythonMatch3.13.0beta3

pythonpythonMatch3.13.0beta4

pythonpythonMatch3.13.0rc1

VendorProductVersionCPE
pythonpython*cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha0:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha1:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha2:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha3:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha4:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha5:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha6:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:beta1:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:beta2:*:*:*:*:*:*

Vendor	Product	Version	CPE
python	python	*	cpe:2.3:a:python:python::::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha0::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha1::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha2::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha3::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha4::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha5::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha6::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:beta1::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:beta2::::::

Rows per page:

1-10 of 131

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CPython",
    "repo": "https://github.com/python/cpython",
    "vendor": "Python Software Foundation",
    "versions": [
      {
        "version": "0",
        "lessThan": "3.8.20",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.9.0",
        "lessThan": "3.9.20",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.10.0",
        "lessThan": "3.10.15",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.11.0",
        "lessThan": "3.11.10",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.12.0",
        "lessThan": "3.12.6",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.13.0a1",
        "lessThan": "3.13.0rc2",
        "status": "affected",
        "versionType": "python"
      }
    ]
  }
]