CVE-2024-7592

NameCVE-2024-7592
DescriptionThere is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
pypy (PTS)jessie2.4.0+dfsg-3vulnerable
stretch5.6.0+dfsg-4vulnerable
buster7.0.0+dfsg-3vulnerable
bullseye7.3.3+dfsg-2vulnerable
python2.7 (PTS)jessie, jessie (lts)2.7.9-2-ds1-1+deb8u12vulnerable
stretch (security)2.7.13-2+deb9u6vulnerable
stretch (lts), stretch2.7.13-2+deb9u9vulnerable
buster (security), buster, buster (lts)2.7.16-2+deb10u4vulnerable
bullseye2.7.18-8+deb11u1vulnerable
python3.11 (PTS)bookworm3.11.2-6+deb12u4vulnerable
bookworm (security)3.11.2-6+deb12u3vulnerable
python3.12 (PTS)sid, trixie3.12.7-3fixed
python3.13 (PTS)sid, trixie3.13.0-2fixed
python3.4 (PTS)jessie, jessie (lts)3.4.2-1+deb8u18vulnerable
python3.5 (PTS)stretch (security)3.5.3-1+deb9u5vulnerable
stretch (lts), stretch3.5.3-1+deb9u10vulnerable
python3.7 (PTS)buster, buster (lts)3.7.3-2+deb10u8vulnerable
buster (security)3.7.3-2+deb10u7vulnerable
python3.9 (PTS)bullseye3.9.2-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
pypysourcejessie(unfixed)end-of-life
pypysource(unstable)(unfixed)
python2.7source(unstable)(unfixed)
python3.11source(unstable)(unfixed)
python3.12source(unstable)3.12.6-1
python3.13source(unstable)3.13.0~rc2-1
python3.4source(unstable)(unfixed)
python3.5source(unstable)(unfixed)
python3.7source(unstable)(unfixed)
python3.9source(unstable)(unfixed)

Notes

[bookworm] - python3.11 <postponed> (Minor issue, wait until merged into 3.11 branch)
[bullseye] - python3.9 <postponed> (Minor issue)
https://github.com/python/cpython/pull/123075
https://github.com/python/cpython/issues/123067
https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621 (v3.13.0rc2)
https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1 (v3.12.6)
https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f (v3.11.10)
https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a (v3.10.15)
https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774 (v3.9.20)
https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/
[jessie] - python3.4 <postponed> (Minor issue)
[stretch] - python3.5 <postponed> (Minor issue)
[buster] - python3.7 <postponed> (Minor issue)

Search for package or bug name: Reporting problems