Threats Tagged 'cve-2024-6232'

This advisory covers a bug fix and enhancement update for python3.12 on Red Hat Enterprise Linux 10. It addresses multiple security issues including a ReDos vulnerability (CVE-2024-6232) in the tarfile module due to excessive backtracking while parsing header values. The update is provided as a bug fix advisory with no explicit security fixes listed for python3.12 in this release, but it includes references to related CVEs. The update affects various Red Hat Enterprise Linux 10 and CodeReady Linux Builder 10 variants across multiple architectures. No known exploits are reported in the wild. The update is available and should be applied according to Red Hat's guidance.

A moderate severity security vulnerability (CVE-2024-6232) has been identified in the Python 3 tarfile module used in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The issue is a Regular Expression Denial of Service (ReDoS) caused by excessive backtracking while parsing header values in tarfile. Red Hat has issued a security advisory with updated python3 packages to address this vulnerability.

CVE-2024-6232 is a high severity vulnerability in CPython affecting the tarfile module. It involves a regular expression that allows excessive backtracking during the parsing of TarFile headers, leading to a Regular Expression Denial of Service (ReDoS) when processing specially crafted tar archives. This vulnerability affects multiple Python versions prior to patched releases. Red Hat has issued an important security update addressing this issue in their python3.9 packages for Red Hat Enterprise Linux 9.2 Extended Update Support. A patch is available to remediate the vulnerability.

There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

HighVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2024-6232#cwe-1333

The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries. CPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.