CVE-2024-6232
CVE Details
Last Update
9/5/24
NIST CVE Summary
There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
Our Official Summary
This CVE affects all images using the Python's tarfile module. A specificlly crafted tar file which causes excessive backtracking while tarfile parses headers is needed to exploit this vulnerability. If the vulnerability is exploited, it can cause a denial of service attack. But from our product point of view, this risk of this vulnerability getting exploited is very low. This is because it does not enable remote code execution. A user has to compromise of the images using this library within python module and feed a specially crafted tar file and relies on the underlying system processing that file, which limits the attack vector. A fix is not available at this time. We will upgrade the library once the fix becomes available.
CVE Severity
Status
Ongoing
Affected Products & Versions
- Palette VerteX 4.4.14, 4.4.18
- Palette Enterprise 4.4.18
Revision History
- 1.0 08/16/2024 Initial Publication
- 2.0 08/17/2024 Added Palette VerteX 4.4.14 to Affected Products
- 3.0 09/17/2024 Added Palette VerteX 4.4.18 & Palette Enterprise 4.4.18 to Affected Products