Skip to content
OpenAdvisories
Medium · 5.3 CVE-2024-21503 EUVD-2024-0019GHSA-fj7x-q9j7-g6q6PYSEC-2024-48

Black vulnerable to Regular Expression Denial of Service (ReDoS)

Published Mar 19, 2024 · Updated Aug 1, 2024 · Assigned by snyk

Package: black Package: black Package: black Package: black Ecosystem: Alpine Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu

Description

Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.

Affected products

VendorProductAffectedFixed
— black < 24.3.0 24.3.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 black 24.4.0-1 —
Debian 13 black 24.4.0-1 —
Debian 12 black No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 black No fix yet —
Ubuntu 25.10 black No fix yet —
Ubuntu 24.04 LTS black No fix yet —
Ubuntu 22.04 LTS black No fix yet —
Ubuntu 20.04 LTS black No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Ansible Automation Platform Inside 2 python-black +1 22.8.0-2.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python-cryptography +1 42.0.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python-jinja2 +1 3.1.4-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python39-black +1 22.8.0-2.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python39-cryptography +1 42.0.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python39-jinja2 +1 3.1.4-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 receptor +1 1.4.8-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-black +1 22.8.0-2.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-cryptography +1 42.0.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-idna +1 3.7-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-jinja2 +1 3.1.4-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-requests +1 2.32.2-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-black +1 22.8.0-2.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-cryptography +1 42.0.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-idna +1 3.7-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-jinja2 +1 3.1.4-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-requests +1 2.32.2-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 receptor +1 1.4.8-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 automation-controller-venv-tower 4.5.7-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 automation-hub +2 4.9.2-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-aiohttp +1 3.9.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-black +1 22.8.0-2.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-cryptography +1 42.0.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-galaxy-ng +1 4.9.2-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-gunicorn +1 22.0.0-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-idna +1 3.7-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-jinja2 +1 3.1.4-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-pillow +1 10.3.0-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-pydantic +1 1.10.15-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-requests +1 2.32.2-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-social-auth-app-django +1 5.4.1-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-sqlparse +1 0.5.0-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-aiohttp +1 3.9.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-black +1 22.8.0-2.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-cryptography +1 42.0.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-gunicorn +1 22.0.0-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-idna +1 3.7-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-jinja2 +1 3.1.4-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-pillow +1 10.3.0-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-pydantic +1 1.10.15-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-requests +1 2.32.2-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-social-auth-app-django +1 5.4.1-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-sqlparse +1 0.5.0-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 receptor +1 1.4.8-1.el8ap RHSA-2024:3781

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-black 26.5.1-1.3 openSUSE-SU-2026:12001-1
openSUSE Leap 15.6 python-black 24.3.0-150400.9.8.1 SUSE-SU-2024:2481-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 black 24.3.0-r0 —
Alpine v3.23 black 24.3.0-r0 —
Alpine v3.22 black 24.3.0-r0 —
Alpine v3.21 black 24.3.0-r0 —
Alpine v3.20 black 24.3.0-r0 —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 black 23.12.0-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI black < 24.3.0 24.3.0 GHSA-fj7x-q9j7-g6q6

Advisories 4

References