Описание
Security update for python-black
This update for python-black fixes the following issues:
Updated to version 24.3.0:
- CVE-2024-21503: Fixed a performance downgrade on docstrings that contain large numbers of leading tab characters (bsc#1221530).
Список пакетов
openSUSE Leap 15.6
python311-black-24.3.0-150400.9.8.1
Ссылки
- Link for SUSE-SU-2024:2481-1
- E-Mail link for SUSE-SU-2024:2481-1
- SUSE Security Ratings
- SUSE Bug 1221530
- SUSE CVE CVE-2024-21503 page
Описание
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Затронутые продукты
openSUSE Leap 15.6:python311-black-24.3.0-150400.9.8.1
Ссылки
- CVE-2024-21503
- SUSE Bug 1221530