High severity · published Aug 19, 2024
CVE-2024-7592
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module
7.5
CVSS
2.3%
EPSS
No
On KEV
Description
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PY
Python · Python
before 3.8.20; 3.9.0 before 3.9.20; 3.10.0 before 3.10.15; 3.11.0 before 3.11.10; 3.12.0 before 3.12.6; 3.13.0; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7592
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7592
Patch
https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621
Patch
https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef
Patch
https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06
Patch
https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a
Patch
https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f
Patch
https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774
More from Python
9.8
CVE-2022-48565
An XML External Entity (XXE) issue was discovered in Python through 3.9.1
9.8
CVE-2022-37454
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate…
9.8
CVE-2021-29921
In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string
9.8
CVE-2021-3177
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept…
9.8
CVE-2020-27619
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP