Critical Vulnerability in CPython Affecting PyPy3 and Python3 Packages
Summary
DEBIAN-CVE-2024-6232: There is a MEDIUM severity vulnerability affecting CPython. Affects pypy3 versions < 7.3.18+dfsg-1. Fixed in 7.3.18+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PyPy3 and Python3 are implementations of the Python programming language, widely used for web development, data analysis, artificial intelligence, and more. These packages provide the core functionalities of Python, enabling developers to build applications efficiently. However, they are vulnerable to a specific issue related to regular expressions that can lead to ReDoS (Regular Expression Denial of Service) attacks when processing specially crafted tar archives.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2024-6232 arises from excessive backtracking in regular expressions during the parsing of tarfile.TarFile headers. This flaw can be exploited by an attacker who crafts malicious tar archives, potentially leading to denial of service by consuming excessive CPU resources. The vulnerability affects multiple versions of PyPy3 and Python3 across different Debian releases, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
7.3.18+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pypy3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted tar archives until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The DEBIAN-CVE-2024-6232 vulnerability poses a significant risk to users of PyPy3 and Python3 packages in Debian. It is crucial to update to the patched versions to mitigate the risk of ReDoS attacks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for pypy3 →
FAQ
It is a vulnerability affecting CPython that allows for ReDoS attacks through excessive backtracking in regular expressions during tarfile header parsing.
The affected packages include PyPy3 and Python3.9, Python3.11, and Python3.13 across various Debian releases.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to denial of service, causing applications to become unresponsive due to excessive CPU resource consumption.
You can update your packages using the command: sudo apt-get update && sudo apt-get upgrade <package_name>, replacing <package_name> with the relevant package.
References
Related vulnerabilities
Recent vulnerabilities recorded for pypy3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
