CVE-2024-21503 Black vulnerable to Regular Expression Denial of Service (ReDoS)
An attacker can cause a denial of service in the Black Python formatter by providing input with excessive leading tabs, triggering a regular expression vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-21503?
CVE-2024-21503 is a medium-severity denial of service vulnerability in black, published on 19 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Which versions are affected by CVE-2024-21503?
3 open source packages ship an affected version, including black.
| Package | Affected | Fixed in |
|---|---|---|
black PyPI | All versions | 24.3.0 |
black PyPI | All versions | 24.3.0 |
black PyPI | All versions | 24.3.0 |
Linux distribution packages (2)
python-black openSUSE:Leap 15.6 | All versions | 24.3.0-150400.9.8.1 |
python-black openSUSE:Tumbleweed | All versions | 26.5.1-1.3 |
How do I fix CVE-2024-21503?
Upgrade black to 24.3.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-21503 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21503 exists.
Sources
Also known as CLEANSTART-2024-EN29810, DEBIAN-CVE-2024-21503, GHSA-fj7x-q9j7-g6q6, PYSEC-2024-48, ROOT-APP-PYPI-CVE-2024-21503, SUSE-SU-2024:2481-1 and 3 more.