CVE-2024-21503
EUVD-2024-001919.03.2024, 05:15
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| python_software_foundation | black | 𝑥 < 24.3.0 | ADP |
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-1333 - Inefficient Regular Expression ComplexityThe product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
- CWE-75 - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)The software does not adequately filter user-controlled input for special elements with control implications.
References