Bug 1219603 (CVE-2024-24762)

Summary:	VUL-0: CVE-2024-24762: python-fastapi: ReDoS(Regular expression Denial of Service) on python-multipart dependency
Product:	[Novell Products] SUSE Security Incidents	Reporter:	SMASH SMASH <smash_bz>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P3 - Medium	CC:	andrea.mattiazzo, pgajdos
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/393040/
Whiteboard:	CVSSv3.1:SUSE:CVE-2024-24762:7.5:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2024-02-06 08:26:40 UTC

FastAPI is a web framework for building APIs with Python 3.8+ based on standard Python type hints. When using form data, `python-multipart` uses a Regular Expression to parse the HTTP `Content-Type` header, including options. An attacker could send a custom-made `Content-Type` option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely (minutes or more) while holding the main event loop. This means that process can't handle any more requests. It's a ReDoS(Regular expression Denial of Service), it only applies to those reading form data, using `python-multipart`. This vulnerability has been patched in version 0.109.0.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24762
https://www.cve.org/CVERecord?id=CVE-2024-24762
https://github.com/tiangolo/fastapi/releases/tag/0.109.1
https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389

Patch:
https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc

Comment 1 Andrea Mattiazzo 2024-02-06 08:40:27 UTC

Tracking as affected:
- SUSE:ALP:Source:Standard:1.0/python-fastapi           
- openSUSE:Factory/python-fastapi

Comment 2 Dirk Mueller 2024-02-06 14:24:17 UTC

this is essentially a duplicate of 1219610

Comment 3 Andrea Mattiazzo 2024-02-06 14:25:50 UTC

Closed since we will fix it through python-multipart package