Security Update for Python 3.9: Addressing ReDos Vulnerability in Tarfile Module
Summary
ALSA-2024:8359: Moderate: python39:3.9 and python39-devel:3.9 security update. Affects python39 versions < 3.9.20-1.module_el8.10.0+3902+1690be06. Fixed in 3.9.20-1.module_el8.10.0+3902+1690be06. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various programming paradigms and includes extensive libraries and frameworks. The Python 3.9 version, particularly, is utilized in numerous applications and environments. However, it has been identified that the tarfile module in Python 3.9 is susceptible to a Regular Expression Denial of Service (ReDos) attack, which can lead to performance degradation or application crashes when processing maliciously crafted input.
Vulnerability Detail
The vulnerability arises from excessive backtracking while parsing header values in the tarfile module of Python 3.9. This flaw can be exploited by an attacker who crafts a specially designed tar file that, when processed, causes the Python interpreter to consume excessive CPU resources, potentially leading to denial of service. The specific CVE associated with this vulnerability is CVE-2024-6232. The impact of this vulnerability can be severe, especially in applications that process untrusted tar files, as it can lead to significant performance issues or application downtime.
How To Fix
Minimum fixed version
3.9.20-1.module_el8.10.0+3902+1690be06
This is the first release that contains the fix.
sudo dnf update python39Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to sanitize and restrict the types of tar files your application processes. This can help mitigate the risk of processing maliciously crafted tar files.
Conclusion
The identified vulnerability in Python 3.9's tarfile module poses a risk of denial of service through ReDos attacks. It is crucial for developers and system administrators to update their Python installations to the patched versions to mitigate this risk. Implementing input validation can serve as a temporary workaround until updates can be applied.
See every vulnerability recorded for python39 →
FAQ
A ReDos attack exploits vulnerabilities in regular expressions to cause excessive backtracking, leading to high CPU usage and potential denial of service.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
If you cannot update immediately, implement input validation to restrict the types of tar files processed by your application as a temporary measure.
While it is classified as moderate, the impact can be significant in applications that handle untrusted input, making it essential to address promptly.
More information can be found on the CVE page for CVE-2024-6232, which details the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for python39.
