Critical Vulnerability in Python Packages: CVE-2024-6232
Summary
UBUNTU-CVE-2024-6232: There is a MEDIUM severity vulnerability affecting CPython. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm21. Fixed in 2.7.6-8ubuntu0.6+esm21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is extensively used in web development, data analysis, artificial intelligence, and more. The affected packages include various versions of Python (2.7, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, and 3.12) across different Ubuntu LTS releases. The vulnerability arises from a flaw in the regular expression handling within the tarfile module, which can lead to excessive backtracking and potential denial of service (ReDoS) attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2024-6232, is a medium severity issue that affects the CPython implementation of Python. It originates from the tarfile.TarFile header parsing, where specifically crafted tar archives can exploit excessive backtracking in regular expressions. This can lead to denial of service, causing the application to hang or crash. The CVSS score for this vulnerability is 7.5, indicating a significant risk to systems using the affected Python packages.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm21
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted tar archives or implement input validation to mitigate the risk of ReDoS attacks until the packages are updated.
Conclusion
CVE-2024-6232 represents a significant vulnerability affecting multiple Python packages across various Ubuntu LTS versions. Users are strongly advised to update their packages to the latest patched versions to mitigate the risk of denial of service attacks. Implementing workarounds can provide temporary relief until updates are applied.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2024-6232 is a vulnerability in Python's tarfile module that allows for denial of service through excessive backtracking in regular expressions.
Affected versions include Python 2.7, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, and 3.12 across various Ubuntu LTS releases.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without signup.
If immediate updates are not possible, avoid processing untrusted tar archives and implement input validation to reduce the risk of exploitation.
The CVSS score for CVE-2024-6232 is 7.5, indicating a high severity risk.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
