Vulnerability Description
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python | Python | < 3.8.20 |
Related Weaknesses (CWE)
References
- https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e6762Patch
- https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ePatch
- https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a0Patch
- https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9Patch
- https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7Patch
- https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c77Patch
- https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33bPatch
- https://github.com/python/cpython/issues/123067ExploitIssue TrackingPatch
- https://github.com/python/cpython/pull/123075Issue TrackingPatch
- https://mail.python.org/archives/list/[email protected]/thread/HXJAAAMailing List
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://security.netapp.com/advisory/ntap-20241018-0006/Third Party Advisory
FAQ
What is CVE-2024-7592?
CVE-2024-7592 is a vulnerability with a CVSS score of 7.5 (HIGH). There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie ...
How severe is CVE-2024-7592?
CVE-2024-7592 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-7592?
Check the references section above for vendor advisories and patch information. Affected products include: Python Python.