CVE-2024-7592 Quadratic complexity parsing cookies with backslashes

2024-08-1919:06:45

CWE-400

PSF

github.com

cve-2024-7592

quadratic complexity

parsing cookies

low severity

cpython

http.cookies

AI Score

7.2

Confidence

High

EPSS

0.001

Percentile

44.5%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

There is a LOW severity vulnerability affecting CPython, specifically the
‘http.cookies’ standard library module.

When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:*"
    ],
    "vendor": "python",
    "product": "cpython",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "3.8.20",
        "versionType": "python"
      },
      {
        "status": "affected",
        "version": "3.9.0",
        "lessThan": "3.9.20",
        "versionType": "python"
      },
      {
        "status": "affected",
        "version": "3.10.0",
        "lessThan": "3.10.15",
        "versionType": "python"
      },
      {
        "status": "affected",
        "version": "3.11.0",
        "lessThan": "3.11.10",
        "versionType": "python"
      },
      {
        "status": "affected",
        "version": "3.12.0",
        "lessThan": "3.12.6",
        "versionType": "python"
      },
      {
        "status": "affected",
        "version": "3.13.0a1",
        "lessThan": "3.13.0rc2",
        "versionType": "python"
      }
    ],
    "defaultStatus": "unaffected"
  }
]