Inefficient regular expression complexity in FastAPI - CVE-2024-24762

Vulnerability identifier: #VU86533

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-24762

CWE-ID: CWE-1333

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing value of the "Content-Type" HTTP header with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

FastAPI
IBM Cloud Pak for Security
App Connect Enterprise Certified Container
IBM Business Automation Workflow
QRadar Suite
Ubuntu
Fedora
python-multipart (Ubuntu package)
python-fastapi

Install update from vendor's website.

FastAPI - update to 0.109.1
QRadar Suite - update to 1.10.19.0
python-multipart (Ubuntu package) - addressed in versions 0.0.5-2ubuntu0.1~esm1, 0.0.9-1ubuntu0.1~esm1
python-fastapi - update to 0.109.1-1.fc40
App Connect Enterprise Certified Container - addressed in versions 5.0.15, 11.3.0
IBM Business Automation Workflow - update to 23.0.2 IF003

• https://github.com/tiangolo/fastapi/security/advisories/GHSA-qf9m-vfgh-m389
• https://github.com/tiangolo/fastapi/commit/9d34ad0ee8a0dfbbcce06f76c2d5d851085024fc
• https://github.com/tiangolo/fastapi/releases/tag/0.109.1

• Remote denial of service in FastAPI
• Fedora 40 update for python-fastapi
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Container
• Inefficient regular expression complexity in IBM Business Automation Workflow
• Ubuntu update for python-multipart