Bug 2309426 (CVE-2024-6232)

Summary: CVE-2024-6232 python: cpython: tarfile: ReDos via excessive backtracking while parsing header values
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bdettelb, dfreiber, doconnor, drow, jburrell, jeder, mijjapur, prodsec-dev, teagle, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---Flags: mijjapur: needinfo? (prodsec-dev)
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A regular expression denial of service (ReDos) vulnerability was found in Python's tarfile module. Due to excessive backtracking while tarfile parses headers, an attacker may be able to trigger a denial of service via a specially crafted tar archive.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2310088, 2310089, 2310090, 2310091, 2310092, 2310093, 2310094, 2310095    
Bug Blocks:    

Description OSIDB Bzimport 2024-09-03 13:20:31 UTC
There is a MEDIUM severity vulnerability affecting CPython.





Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

Comment 1 errata-xmlrpc 2024-09-23 01:54:52 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:6909 https://access.redhat.com/errata/RHSA-2024:6909

Comment 2 errata-xmlrpc 2024-09-24 02:58:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:6975 https://access.redhat.com/errata/RHSA-2024:6975

Comment 3 errata-xmlrpc 2024-10-01 02:29:28 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:7415 https://access.redhat.com/errata/RHSA-2024:7415

Comment 4 errata-xmlrpc 2024-10-03 18:24:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:7647 https://access.redhat.com/errata/RHSA-2024:7647

Comment 7 errata-xmlrpc 2024-10-15 10:39:25 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2024:8130 https://access.redhat.com/errata/RHSA-2024:8130

Comment 8 errata-xmlrpc 2024-10-23 10:17:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:8359 https://access.redhat.com/errata/RHSA-2024:8359

Comment 9 errata-xmlrpc 2024-10-23 13:22:16 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:8374 https://access.redhat.com/errata/RHSA-2024:8374

Comment 10 errata-xmlrpc 2024-10-24 11:59:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:8447 https://access.redhat.com/errata/RHSA-2024:8447

Comment 11 errata-xmlrpc 2024-10-24 12:21:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:8446 https://access.redhat.com/errata/RHSA-2024:8446

Comment 12 errata-xmlrpc 2024-10-28 00:25:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support

Via RHSA-2024:8490 https://access.redhat.com/errata/RHSA-2024:8490

Comment 13 errata-xmlrpc 2024-10-28 08:36:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:8504 https://access.redhat.com/errata/RHSA-2024:8504

Comment 14 errata-xmlrpc 2024-11-04 05:54:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2024:8797 https://access.redhat.com/errata/RHSA-2024:8797

Comment 15 errata-xmlrpc 2024-11-05 02:46:31 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:8838 https://access.redhat.com/errata/RHSA-2024:8838

Comment 16 errata-xmlrpc 2024-11-05 04:00:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:8836 https://access.redhat.com/errata/RHSA-2024:8836

Comment 17 errata-xmlrpc 2024-11-07 03:22:09 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2024:8977 https://access.redhat.com/errata/RHSA-2024:8977