CVE-2024-7592
Quadratic complexity parsing cookies with backslashes
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
There is a LOW severity vulnerability affecting CPython, specifically the
'http.cookies' standard library module.
When parsing cookies that contained backslashes for quoted characters in
the cookie value, the parser would use an algorithm with quadratic
complexity, resulting in excess CPU resources being used while parsing the
value.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-08-07 CVE Reserved
- 2024-08-19 CVE Published
- 2024-09-05 EPSS Updated
- 2024-10-18 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (9)
URL | Tag | Source |
---|---|---|
https://github.com/python/cpython/issues/123067 | Issue Tracking |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Python Software Foundation Search vendor "Python Software Foundation" | CPython Search vendor "Python Software Foundation" for product "CPython" | < 3.8.20 Search vendor "Python Software Foundation" for product "CPython" and version " < 3.8.20" | en |
Affected
| ||||||
Python Software Foundation Search vendor "Python Software Foundation" | CPython Search vendor "Python Software Foundation" for product "CPython" | >= 3.9.0 < 3.9.20 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.9.0 < 3.9.20" | en |
Affected
| ||||||
Python Software Foundation Search vendor "Python Software Foundation" | CPython Search vendor "Python Software Foundation" for product "CPython" | >= 3.10.0 < 3.10.15 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.10.0 < 3.10.15" | en |
Affected
| ||||||
Python Software Foundation Search vendor "Python Software Foundation" | CPython Search vendor "Python Software Foundation" for product "CPython" | >= 3.11.0 < 3.11.10 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.11.0 < 3.11.10" | en |
Affected
| ||||||
Python Software Foundation Search vendor "Python Software Foundation" | CPython Search vendor "Python Software Foundation" for product "CPython" | >= 3.12.0 < 3.12.6 Search vendor "Python Software Foundation" for product "CPython" and version " >= 3.12.0 < 3.12.6" | en |
Affected
|