Bug 2270236 (CVE-2024-21503)

Summary:	CVE-2024-21503 psf/black: ReDoS via the lines_with_leading_tabs_expanded() function in strings.py file
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	davidn, epacific, jcammara, jhardy, jneedle, jobarker, mabashia, osapryki, simaishi, smcdonal, teagle, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	black 24.3.0	Doc Type:	If docs needed, set a value
Doc Text:	The python-black package is susceptible to a regular expression denial of service (ReDoS) vulnerability, found in the lines_with_leading_tabs_expanded() function within the strings.py file. This vulnerability could be exploited by running Black on untrusted input or by inserting numerous leading tab characters into docstrings. This flaw allows attackers to craft malicious input to trigger a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2270238
Bug Blocks:	2270240

Description TEJ RATHI 2024-03-19 07:37:20 UTC

Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.

https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8
https://github.com/psf/black/releases/tag/24.3.0
https://security.snyk.io/vuln/SNYK-PYTHON-BLACK-6256273

Comment 1 TEJ RATHI 2024-03-19 07:39:08 UTC

Created python-black tracking bugs for this issue:

Affects: fedora-all [bug 2270238]