Regular-expression DoS when parsing TarFile headers (CVE-2024-6232)

Summary

Regular-expression DoS when parsing TarFile headers

Original description

The description as published by the source.

There is a MEDIUM severity vulnerability affecting CPython.

Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami libpython

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.8.20"},{"introduced":"3.9.0"},{"fixed":"3.9.20"},{"introduced":"3.10.0"},{"fixed":"3.10.15"},{"introduced":"3.11.0"},{"fixed":"3.11.10"},{"introduced":"3.12.0"},{"fixed":"3.12.6"}]}]

Bitnami python

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.8.20"},{"introduced":"3.9.0"},{"fixed":"3.9.20"},{"introduced":"3.10.0"},{"fixed":"3.10.15"},{"introduced":"3.11.0"},{"fixed":"3.11.10"},{"introduced":"3.12.0"},{"fixed":"3.12.6"}]}]

Bitnami python-min

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.8.20"},{"introduced":"3.9.0"},{"fixed":"3.9.20"},{"introduced":"3.10.0"},{"fixed":"3.10.15"},{"introduced":"3.11.0"},{"fixed":"3.11.10"},{"introduced":"3.12.0"},{"fixed":"3.12.6"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2024-6232 python3 Fixed in: 3.10.15-r0
Debian DEBIAN-CVE-2024-6232 pypy3 Fixed in: 7.3.5+dfsg-2+deb11u5

References

advisory openwall.com
advisory mail.python.org
advisory security.netapp.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
patch github.com
web lists.debian.org
web nvd.nist.gov