CVE-2024-21503 (Medium) detected in black-21.9b0-py3-none-any.whl

[mend-bolt-for-github]

CVE-2024-21503 - Medium Severity Vulnerability

Vulnerable Library - black-21.9b0-py3-none-any.whl

The uncompromising code formatter.

Library home page: https://files.pythonhosted.org/packages/d2/16/a92c999103bee1236dd93f703f3522217fe00bd97bd50ae3699c2d91e320/black-21.9b0-py3-none-any.whl

Path to dependency file: /backend/requirements.txt

Path to vulnerable library: /backend/requirements.txt

Dependency Hierarchy:

• ❌ black-21.9b0-py3-none-any.whl (Vulnerable Library)

Found in base branch: dev

Vulnerability Details

Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.

Publish Date: 2024-03-19

URL: CVE-2024-21503

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fj7x-q9j7-g6q6

Release Date: 2024-03-19

Fix Resolution: black - 24.3.0

---

Step up your Open Source Security Game with Mend here