CoreCVE
Back

HIGH

Regular-expression DoS when parsing TarFile headers

Published Sep 3, 2024

Description

There is a MEDIUM severity vulnerability affecting CPython.

Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.

Affected products

Remediation

Red Hat statement

This vulnerability is classified as moderate severity rather than important because while it does allow for a denial of service (DoS) attack via excessive backtracking in the tarfile module, it does not enable remote code execution or compromise the integrity or confidentiality of data. Exploitation requires an attacker to provide a specially crafted tar archive and relies on the victim's system processing that file, which limits the attack vector. Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (1)

CWE-1333

References (17)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner PSF
Published Sep 3, 2024
Updated Nov 3, 2025
Reserved Jun 20, 2024
Link CVE-2024-6232
CISA Vulnrichment
Updated Dec 4, 2024
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2024-6232
Red Hat
Severity Moderate
Public date Sep 3, 2024
Links CVE-2024-6232 - Bugzilla