Moderate Vulnerability in Python 3.9: ReDos via Excessive Backtracking in Tarfile Module
Summary
ALSA-2024:9468: Moderate: python3.9 security update. Affects python-unversioned-command versions < 3.9.19-8.el9_5.1. Fixed in 3.9.19-8.el9_5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.9 is an interpreted, interactive, object-oriented programming language widely used for various applications, from web development to data analysis. It features dynamic typing, high-level data types, and extensive libraries that facilitate rapid development. However, this version has been identified to contain a vulnerability in the tarfile module, which can be exploited through regular expression denial of service (ReDos) attacks, potentially affecting applications that rely on this module for processing tar files.
Vulnerability Detail
The vulnerability arises from excessive backtracking while parsing header values in the tarfile module of Python 3.9, identified as CVE-2024-6232. This flaw allows an attacker to craft a malicious tar file that, when processed, can cause the application to hang or crash due to the excessive computational resources required for regex evaluation. The impact of this vulnerability can lead to service downtime and denial of access for legitimate users, making it critical to address.
How To Fix
Minimum fixed version
3.9.19-8.el9_5.1
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid processing untrusted tar files until the update has been applied. Implementing strict validation on input files can help mitigate the risk of exploitation.
Conclusion
The identified vulnerability in Python 3.9's tarfile module poses a moderate risk due to the potential for denial of service attacks. It is crucial for users to update to the patched version to safeguard their applications. Implementing best practices for file handling can further mitigate risks until updates are applied.
See every vulnerability recorded for python-unversioned-command →
FAQ
CVE-2024-6232 is a vulnerability in Python 3.9's tarfile module that allows for regular expression denial of service (ReDos) attacks due to excessive backtracking.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json.
Exploitation of this vulnerability can lead to application crashes or hangs, resulting in denial of service for legitimate users.
Yes, avoid processing untrusted tar files and implement strict validation on input files to reduce the risk of exploitation.
For more details, refer to the CVE page associated with CVE-2024-6232 or consult the official Python documentation.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
