CVE-2024-7592
Publication date 19 August 2024
Last updated 19 September 2024
Ubuntu priority
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting in excess CPU resources being used while parsing the value.
Why is this CVE low priority?
Per upstream developers, this is a low severity issue
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| python2.7 | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy |
Fixed 2.7.18-13ubuntu1.2+esm2
|
|
| 20.04 LTS focal |
Fixed 2.7.18-1~20.04.4+esm2
|
|
| 18.04 LTS bionic |
Fixed 2.7.17-1~18.04ubuntu1.13+esm5
|
|
| 16.04 LTS xenial |
Fixed 2.7.12-1ubuntu0~16.04.18+esm10
|
|
| 14.04 LTS trusty |
Fixed 2.7.6-8ubuntu0.6+esm20
|
|
| python3.10 | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy |
Fixed 3.10.12-1~22.04.6
|
|
| 20.04 LTS focal | Not in release | |
| python3.11 | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal | Not in release | |
| python3.12 | 24.10 oracular |
Not affected
|
| 24.04 LTS noble |
Fixed 3.12.3-1ubuntu0.2
|
|
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| python3.13 | 24.10 oracular |
Not affected
|
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| python3.4 | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 14.04 LTS trusty | Ignored end of ESM support, was needs-triage | |
| python3.5 | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 16.04 LTS xenial |
Fixed 3.5.2-2ubuntu0~16.04.13+esm14
|
|
| 14.04 LTS trusty |
Fixed 3.5.2-2ubuntu0~16.04.4~14.04.1+esm3
|
|
| python3.6 | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Needs evaluation
|
|
| python3.7 | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal | Not in release | |
| 18.04 LTS bionic |
Needs evaluation
|
|
| python3.8 | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Fixed 3.8.10-0ubuntu1~20.04.12
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| python3.9 | 24.10 oracular | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Needs evaluation
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProPatch details
| Package | Patch details |
|---|---|
| python3.10 |
|
| python3.11 |
|
| python3.12 |
|
| python3.13 |
|
| python3.8 |
|
| python3.9 |
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.5 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-7015-1
- Python vulnerabilities
- 16 September 2024
- USN-7015-2
- Python vulnerabilities
- 19 September 2024