CVE search · CVE-2024-7592
CVE-2024-7592
high 7.5
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cna@python.org
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
nvd@nist.govPrimary |
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- python · python
References
- https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621Patch
- https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5efPatch
- https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06Patch
- https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9aPatch
- https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7fPatch
- https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774Patch
- https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1Patch
- https://github.com/python/cpython/issues/123067ExploitIssue TrackingPatch
- https://github.com/python/cpython/pull/123075Issue TrackingPatch
- https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/Mailing List
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://security.netapp.com/advisory/ntap-20241018-0006/Third Party Advisory