p PatchFirst

CVE-2024-21503

CVE-2024-21503

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.

CVSS 5.3 · Medium · EPSS 1.0% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • black

    Versions
    • ≥ 0, < 24.3.0: Affected (semver)

    Update to 24.3.0

  • black Debian:12

    Versions
    • 23.1.0-1
    • 23.10.0-1
    • 23.10.1-1
    • 23.11.0-1
    • 23.3.0-1
    • 23.3.0-1~exp1
    • 23.7.0-1
    • 23.9.1-1
    • 24.1.1-1
    • 24.10.0-1
    • 24.10.0-2
    • 24.10.0-3
    • 24.2.0-1
    • 24.4.0-1
    • 24.4.0-2
    • 24.4.2-1
    • 24.4.2-2
    • 24.4.2-2~0exp0
    • 24.8.0-1
    • 25.1.0-0exp
    • 25.1.0-1
    • 25.1.0-2
    • 25.1.0-3
    • 25.11.0-1
    • 25.12.0-1
    • 25.12.0-2
    • 25.9.0-1
    • 26.1.0-1
    • 26.3.1-1
    • 26.5.1-1
    • 26.5.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Debian:13

    Affected ranges
    • ECOSYSTEM: < 24.4.0-1

    Update to 24.4.0-1

  • black Debian:14

    Affected ranges
    • ECOSYSTEM: < 24.4.0-1

    Update to 24.4.0-1

  • black PyPI

    Versions
    • 18.3a0
    • 18.3a1
    • 18.3a2
    • 18.3a3
    • 18.3a4
    • 18.4a0
    • 18.4a1
    • 18.4a2
    • 18.4a3
    • 18.4a4
    • 18.5b0
    • 18.5b1
    • 18.6b0
    • 18.6b1
    • 18.6b2
    • 18.6b3
    • 18.6b4
    • 18.9b0
    • 19.10b0
    • 19.3b0
    • 20.8b0
    • 20.8b1
    • 21.10b0
    • 21.11b0
    • 21.11b1
    • 21.12b0
    • 21.4b0
    • 21.4b1
    • 21.4b2
    • 21.5b0
    • 21.5b1
    • 21.5b2
    • 21.6b0
    • 21.7b0
    • 21.8b0
    • 21.9b0
    • 22.1.0
    • 22.10.0
    • 22.12.0
    • 22.3.0
    • 22.6.0
    • 22.8.0
    • 23.1.0
    • 23.10.0
    • 23.10.1
    • 23.11.0
    • 23.12.0
    • 23.12.1
    • 23.1a1
    • 23.3.0
    • 23.7.0
    • 23.9.0
    • 23.9.1
    • 24.1.0
    • 24.1.1
    • 24.1a1
    • 24.2.0
    Affected ranges
    • ECOSYSTEM: < 24.3.0

    Update to 24.3.0

  • black PyPI

    Versions
    • 18.3a0
    • 18.3a1
    • 18.3a2
    • 18.3a3
    • 18.3a4
    • 18.4a0
    • 18.4a1
    • 18.4a2
    • 18.4a3
    • 18.4a4
    • 18.5b0
    • 18.5b1
    • 18.6b0
    • 18.6b1
    • 18.6b2
    • 18.6b3
    • 18.6b4
    • 18.9b0
    • 19.10b0
    • 19.3b0
    • 20.8b0
    • 20.8b1
    • 21.10b0
    • 21.11b0
    • 21.11b1
    • 21.12b0
    • 21.4b0
    • 21.4b1
    • 21.4b2
    • 21.5b0
    • 21.5b1
    • 21.5b2
    • 21.6b0
    • 21.7b0
    • 21.8b0
    • 21.9b0
    • 22.1.0
    • 22.10.0
    • 22.12.0
    • 22.3.0
    • 22.6.0
    • 22.8.0
    • 23.1.0
    • 23.10.0
    • 23.10.1
    • 23.11.0
    • 23.12.0
    • 23.12.1
    • 23.1a1
    • 23.3.0
    • 23.7.0
    • 23.9.0
    • 23.9.1
    • 24.1.0
    • 24.1.1
    • 24.1a1
    • 24.2.0
    Affected ranges
    • GIT: < f00093672628d212b8965a8993cee8bedf5fe9b8
    • ECOSYSTEM: < 24.3.0

    Update to 24.3.0

  • black Ubuntu:20.04:LTS

    Versions
    • 19.3b0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:22.04:LTS

    Versions
    • 20.8b1-4
    • 21.4b2-3
    • 21.10b0-1
    • 21.12b0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:24.04:LTS

    Versions
    • 23.7.0-1
    • 23.10.1-1
    • 23.11.0-1
    • 24.2.0-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:25.10

    Versions
    • 25.1.0-2
    • 25.1.0-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:26.10

    Versions
    • 26.3.1-1
    • 26.5.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • black Ubuntu:26.04:LTS

    Versions
    • 25.1.0-3
    • 25.9.0-1
    • 25.11.0-1
    • 25.12.0-1
    • 26.1.0-1
    • 26.1.0-1build1
    • 26.3.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →