Excessive Backtracking in Tarfile Header Parsing Could Lead to ReDoS Vulnerability

CVE-2024-6232

What is CVE-2024-6232?

A vulnerability has been identified in CPython's tarfile module that permits ReDoS (Regular Expression Denial of Service) attacks. This vulnerability arises from excessive backtracking within the regular expressions used for parsing TarFile headers. Specifically crafted tar archives can exploit this weakness, potentially allowing an attacker to cause denial of service by consuming excessive computational resources. Users of affected versions are advised to apply available patches to mitigate this issue.

References