CVE-2024-21503

Name	CVE-2024-21503
Description	Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1067177

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
black (PTS)	bullseye	20.8b1-4	vulnerable
	bookworm	23.1.0-1	vulnerable
	trixie	25.1.0-3	fixed
	forky, sid	25.11.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
black	source	(unstable)	24.4.0-1			1067177

Notes

[bookworm] - black <ignored> (Minor issue)
[bullseye] - black <no-dsa> (Minor issue)
[buster] - black <postponed> (Minor issue; can be fixed in next update)
https://security.snyk.io/vuln/SNYK-PYTHON-BLACK-6256273
https://github.com/psf/black/releases/tag/24.3.0
https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8 (24.3.0)