Lucene search

PSFCVE-2024-7592

HistoryAug 19, 2024 - 7:15 p.m.

CVE-2024-7592

2024-08-1919:15:08

CWE-1333

CWE-400

PSF

web.nvd.nist.gov

cpython

http.cookies

low severity

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

44.5%

JSON

There is a LOW severity vulnerability affecting CPython, specifically the
‘http.cookies’ standard library module.

When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.

Affected configurations

Nvd

Node

pythonpythonRange≤3.12.5

pythonpythonMatch3.13.0alpha0

pythonpythonMatch3.13.0alpha1

pythonpythonMatch3.13.0alpha2

pythonpythonMatch3.13.0alpha3

pythonpythonMatch3.13.0alpha4

pythonpythonMatch3.13.0alpha5

pythonpythonMatch3.13.0alpha6

pythonpythonMatch3.13.0beta1

pythonpythonMatch3.13.0beta2

pythonpythonMatch3.13.0beta3

pythonpythonMatch3.13.0beta4

pythonpythonMatch3.13.0rc1

VendorProductVersionCPE
pythonpython*cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha0:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha1:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha2:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha3:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha4:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha5:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:alpha6:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:beta1:*:*:*:*:*:*
pythonpython3.13.0cpe:2.3:a:python:python:3.13.0:beta2:*:*:*:*:*:*

Vendor	Product	Version	CPE
python	python	*	cpe:2.3:a:python:python::::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha0::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha1::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha2::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha3::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha4::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha5::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:alpha6::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:beta1::::::
python	python	3.13.0	cpe:2.3:a:python:python:3.13.0:beta2::::::

Rows per page:

1-10 of 131

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CPython",
    "repo": "https://github.com/python/cpython",
    "vendor": "Python Software Foundation",
    "versions": [
      {
        "version": "0",
        "lessThan": "3.8.20",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.9.0",
        "lessThan": "3.9.20",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.10.0",
        "lessThan": "3.10.15",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.11.0",
        "lessThan": "3.11.10",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.12.0",
        "lessThan": "3.12.6",
        "status": "affected",
        "versionType": "python"
      },
      {
        "version": "3.13.0a1",
        "lessThan": "3.13.0rc2",
        "status": "affected",
        "versionType": "python"
      }
    ]
  }
]