Moderate Vulnerability in Python 3.12: ReDos via Excessive Backtracking
Summary
RLSA-2024:8447: Moderate: python3.12 security update. Affects python3.12 versions < 0:3.12.1-4.el9_4.4. Fixed in 0:3.12.1-4.el9_4.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is a high-level, dynamically typed, interpreted programming language known for its emphasis on code readability and extensive standard library. It serves as the reference interpreter for the Python language, version 3, and is widely used in various applications. The python3.12 package includes the core interpreter, while additional libraries and documentation are provided in related packages. This version is susceptible to a security issue that can lead to denial of service through regular expression vulnerabilities.
Vulnerability Detail
The vulnerability arises from a Regular Expression Denial of Service (ReDos) issue in the tarfile module of Python's cpython implementation. Specifically, it allows for excessive backtracking while parsing header values, which can lead to significant performance degradation or application crashes. This vulnerability is identified as CVE-2024-6232 and poses a risk to applications that utilize the tarfile module for processing tar archives, potentially allowing attackers to exploit this weakness to disrupt service.
How To Fix
Minimum fixed version
0:3.12.1-4.el9_4.4
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider avoiding the use of the tarfile module for processing untrusted input until the package can be updated. Implementing input validation and sanitization can also help mitigate the risk temporarily.
Conclusion
The vulnerability in Python 3.12, identified as CVE-2024-6232, poses a moderate risk due to potential denial of service through regular expression issues in the tarfile module. It is crucial to update to the patched version to secure applications against this threat. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2024-6232 is a vulnerability in Python 3.12 that allows for denial of service through excessive backtracking in regular expressions used in the tarfile module.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to application crashes or significant performance issues, especially when processing maliciously crafted tar files.
Yes, you can avoid using the tarfile module for untrusted input and implement input validation to reduce the risk until an update can be applied.
More details can be found on the CVE page for CVE-2024-6232, which provides insights into the impact and technical specifics of the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
