← Back

CVE-2024-6232

nvd nist
Published: Sep 3, 2024Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

Affected (17)

Products: Python: Python
Python
1 product
Python
Configuration A
17 vulnerable
Vulnerable SoftwareAffected Versions
Python
Python
Before 3.8.20
Python
From 3.10.0 to 3.10.15
Python
From 3.11.0 to 3.11.10
Python
From 3.12.0 to 3.12.6
Python
From 3.9.0 to 3.9.20
Python
Version 3.13.0 alpha0
Python
Version 3.13.0 alpha1
Python
Version 3.13.0 alpha2
Python
Version 3.13.0 alpha3
Python
Version 3.13.0 alpha4
Python
Version 3.13.0 alpha5
Python
Version 3.13.0 alpha6
Python
Version 3.13.0 beta1
Python
Version 3.13.0 beta2
Python
Version 3.13.0 beta3
Python
Version 3.13.0 beta4
Python
Version 3.13.0 rc1

Related CWEs

CWE-1333
Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References (13)

Source: cna@python.org
Patch
Source: cna@python.org
Patch
Source: cna@python.org
Patch
Source: cna@python.org
Patch
Source: cna@python.org
Patch
Source: cna@python.org
Patch
Source: cna@python.org
Patch
Source: cna@python.org
ExploitIssue TrackingPatch
Source: cna@python.org
Issue TrackingPatch
Source: cna@python.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.