Threats Tagged 'cve-2024-7592'

CVE-2024-7592 is a vulnerability in the Python standard library module http.cookies that causes quadratic complexity when parsing cookies containing backslashes in quoted characters. This results in excessive CPU resource consumption during parsing. The issue affects multiple Python versions prior to specific fixed releases. Red Hat has issued security advisories rating the impact as low and providing updates for affected Python packages. No known exploits are reported in the wild. A patch is available to address the vulnerability.

There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.

HighVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2024-7592#cwe-400

A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContext, such as during the TLS handshake with a certificate directory configured. This issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.