There is a MEDIUM severity vulnerability affecting CPython.
Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Python | Python | * | 3.12.5 (including) |
| Python | Python | 3.13.0-alpha0 (including) | 3.13.0-alpha0 (including) |
| Python | Python | 3.13.0-alpha1 (including) | 3.13.0-alpha1 (including) |
| Python | Python | 3.13.0-alpha2 (including) | 3.13.0-alpha2 (including) |
| Python | Python | 3.13.0-alpha3 (including) | 3.13.0-alpha3 (including) |
| Python | Python | 3.13.0-alpha4 (including) | 3.13.0-alpha4 (including) |
| Python | Python | 3.13.0-alpha5 (including) | 3.13.0-alpha5 (including) |
| Python | Python | 3.13.0-alpha6 (including) | 3.13.0-alpha6 (including) |
| Python | Python | 3.13.0-beta1 (including) | 3.13.0-beta1 (including) |
| Python | Python | 3.13.0-beta2 (including) | 3.13.0-beta2 (including) |
| Python | Python | 3.13.0-beta3 (including) | 3.13.0-beta3 (including) |
| Python | Python | 3.13.0-beta4 (including) | 3.13.0-beta4 (including) |
| Python | Python | 3.13.0-rc1 (including) | 3.13.0-rc1 (including) |
| Red Hat Enterprise Linux 7.7 Advanced Update Support | RedHat | python3-0:3.6.8-10.el7_7.1 | * |
| Red Hat Enterprise Linux 8 | RedHat | python3-0:3.6.8-67.el8_10 | * |
| Red Hat Enterprise Linux 8 | RedHat | python39:3.9-8100020240927003152.d47b87a4 | * |
| Red Hat Enterprise Linux 8 | RedHat | python39-devel:3.9-8100020240927003152.d47b87a4 | * |
| Red Hat Enterprise Linux 8 | RedHat | python3.12-0:3.12.6-1.el8_10 | * |
| Red Hat Enterprise Linux 8 | RedHat | python3.11-0:3.11.10-1.el8_10 | * |
| Red Hat Enterprise Linux 8 | RedHat | python3-0:3.6.8-67.el8_10 | * |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | RedHat | python39:3.9-8040020241017072554.63cd9eba | * |
| Red Hat Enterprise Linux 8.4 Telecommunications Update Service | RedHat | python39:3.9-8040020241017072554.63cd9eba | * |
| Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | RedHat | python39:3.9-8040020241017072554.63cd9eba | * |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | RedHat | python39:3.9-8060020241017081122.6a631399 | * |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | RedHat | python39:3.9-8060020241017081122.6a631399 | * |
| Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | RedHat | python39:3.9-8060020241017081122.6a631399 | * |
| Red Hat Enterprise Linux 8.8 Extended Update Support | RedHat | python3.11-0:3.11.2-2.el8_8.4 | * |
| Red Hat Enterprise Linux 8.8 Extended Update Support | RedHat | python39:3.9-8080020241016061730.93c2fc2f | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.11-0:3.11.7-1.el9_4.6 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.9-0:3.9.18-3.el9_4.6 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.12-0:3.12.1-4.el9_4.4 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.11-0:3.11.9-7.el9_5.1 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.12-0:3.12.5-2.el9_5.1 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.9-0:3.9.19-8.el9_5.1 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.9-0:3.9.18-3.el9_4.6 | * |
| Red Hat Enterprise Linux 9 | RedHat | python3.9-0:3.9.19-8.el9_5.1 | * |
| Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | RedHat | python3.9-0:3.9.10-4.el9_0.6 | * |
| Red Hat Enterprise Linux 9.2 Extended Update Support | RedHat | python3.9-0:3.9.16-1.el9_2.8 | * |
| Red Hat Enterprise Linux 9.2 Extended Update Support | RedHat | python3.11-0:3.11.2-2.el9_2.6 | * |
| Python2.7 | Ubuntu | bionic | * |
| Python2.7 | Ubuntu | trusty | * |
| Python2.7 | Ubuntu | xenial | * |
| Python3.10 | Ubuntu | jammy | * |
| Python3.12 | Ubuntu | noble | * |
| Python3.12 | Ubuntu | upstream | * |
| Python3.13 | Ubuntu | upstream | * |
| Python3.4 | Ubuntu | trusty | * |
| Python3.5 | Ubuntu | esm-infra/xenial | * |
| Python3.5 | Ubuntu | trusty | * |
| Python3.5 | Ubuntu | trusty/esm | * |
| Python3.5 | Ubuntu | xenial | * |
| Python3.6 | Ubuntu | bionic | * |
| Python3.7 | Ubuntu | bionic | * |
| Python3.8 | Ubuntu | bionic | * |
| Python3.8 | Ubuntu | focal | * |
Attackers can create crafted inputs that
intentionally cause the regular expression to use
excessive backtracking in a way that causes the CPU
consumption to spike.