CVE-2024-21503
Black vulnerable to Regular Expression Denial of Service (ReDoS)
5.3 MediumFix available
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
0.98%Up 0.9 points since Mar 19, 2024
What each source reports
CVE List Score used
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
- Record
CVE-2024-21503- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P - Weakness
- CWE-1333, CWE-75
- Updated
- 2026-11-02
EUVDEUVD-2024-0019
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
- Record
EUVD-2024-0019- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fj7x-q9j7-g6q6
Black vulnerable to Regular Expression Denial of Service (ReDoS)
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.
Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
- Record
GHSA-fj7x-q9j7-g6q6- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-75, CWE-1333
- Updated
- 2026-11-02
NVD
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
- Record
CVE-2024-21503- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333, CWE-75
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-21503
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
- Record
ALPINE-CVE-2024-21503- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
OSV
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
- Record
CVE-2024-21503- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
Show 9 moreShow less
OSVDEBIAN-CVE-2024-21503
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
- Record
DEBIAN-CVE-2024-21503- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-fj7x-q9j7-g6q6
Black vulnerable to Regular Expression Denial of Service (ReDoS)
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.
Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
- Record
GHSA-fj7x-q9j7-g6q6- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-1333, CWE-75
- Updated
- 2026-11-02
OSVRHSA-2024:3781
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Record
RHSA-2024:3781- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-21503
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
- Record
UBUNTU-CVE-2024-21503- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13783-1 No score
python310-black-24.3.0-1.1 on GA media
These are all security issues fixed in the python310-black-24.3.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13783-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12001-1 No score
python313-black-26.5.1-1.3 on GA media
These are all security issues fixed in the python313-black-26.5.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12001-1- Updated
- 2026-11-02
OSVPYSEC-2024-48 No score
Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.
- Record
PYSEC-2024-48- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2024-21503 No score
CVE-2024-21503 in rootio-black - Patched by Root
Root has patched CVE-2024-21503 in the rootio-black package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2024-21503- Updated
- 2026-11-02
OSVSUSE-SU-2024:2481-1 No score
Security update for python-black
This update for python-black fixes the following issues:
Updated to version 24.3.0:
- CVE-2024-21503: Fixed a performance downgrade on docstrings that contain large numbers of leading tab characters (bsc#1221530).
- Record
SUSE-SU-2024:2481-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
blackPyPI |
before 24.3.0 | 24.3.0 |
blackAlpine:v3.19 |
before 23.12.0-r0 | 23.12.0-r0 |
blackAlpine:v3.20 |
before 24.3.0-r0 | 24.3.0-r0 |
blackAlpine:v3.21 |
before 24.3.0-r0 | 24.3.0-r0 |
blackAlpine:v3.22 |
before 24.3.0-r0 | 24.3.0-r0 |
blackAlpine:v3.23 |
before 24.3.0-r0 | 24.3.0-r0 |
blackAlpine:v3.24 |
before 24.3.0-r0 | 24.3.0-r0 |
blackDebian:12 |
All versions, plus listed versions 23.1.0-123.10.0-123.10.1-123.11.0-123.3.0-1 Show 29 moreShow less23.3.0-1~exp123.7.0-123.9.1-124.1.1-124.10.0-124.10.0-224.10.0-324.2.0-124.4.0-124.4.0-224.4.2-124.4.2-224.4.2-2~0exp024.8.0-125.1.0-0exp25.1.0-125.1.0-225.1.0-325.11.0-125.12.0-125.12.0-225.9.0-126.1.0-126.10.0-126.10.0-226.10.1-126.3.1-126.5.1-126.5.1-2 |
None known |
blackDebian:13 |
before 24.4.0-1 | 24.4.0-1 |
blackDebian:14 |
before 24.4.0-1 | 24.4.0-1 |
Show 126 moreShow less
| Package | Affected | Fixed |
|---|---|---|
blackPyPI |
before 24.3.0, plus listed versions 18.3a018.3a118.3a218.3a318.3a4 Show 45 moreShow less18.4a018.4a118.4a218.4a318.4a418.5b018.5b118.6b018.6b118.6b218.6b318.6b418.9b019.10b019.3b020.8b020.8b121.10b021.11b021.11b121.12b021.4b021.4b121.4b221.5b021.5b121.5b221.6b021.7b021.8b021.9b022.1.022.10.022.12.022.3.022.6.022.8.023.1.023.10.023.10.123.11.023.12.023.12.123.1a123.3.0 |
24.3.0 |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:4.5.7-1.el8ap | 0:4.5.7-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:4.5.7-1.el9ap | 0:4.5.7-1.el9ap |
receptorRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el8ap | 0:1.4.8-1.el8ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el8ap | 0:1.4.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el8ap | 0:1.4.8-1.el8ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el8ap | 0:1.4.8-1.el8ap |
receptorRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el8ap | 0:1.4.8-1.el8ap |
receptorctlRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el8ap | 0:1.4.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el9ap | 0:1.4.8-1.el9ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el9ap | 0:1.4.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el9ap | 0:1.4.8-1.el9ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el9ap | 0:1.4.8-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el9ap | 0:1.4.8-1.el9ap |
receptorctlRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:1.4.8-1.el9ap | 0:1.4.8-1.el9ap |
python39-cryptographyRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python39-cryptography-debuginfoRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python3x-cryptographyRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python3x-cryptography-debugsourceRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python39-cryptographyRed Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python39-cryptography-debuginfoRed Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python3x-cryptographyRed Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python3x-cryptography-debugsourceRed Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python39-cryptographyRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python39-cryptography-debuginfoRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python3x-cryptographyRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python3x-cryptography-debugsourceRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el8ap | 0:42.0.5-1.el8ap |
python-cryptographyRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python-cryptography-debugsourceRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python3-cryptographyRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python3-cryptography-debuginfoRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python-cryptographyRed Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python-cryptography-debugsourceRed Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python3-cryptographyRed Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python3-cryptography-debuginfoRed Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python-cryptographyRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python-cryptography-debugsourceRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python3-cryptographyRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python3-cryptography-debuginfoRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:42.0.5-1.el9ap | 0:42.0.5-1.el9ap |
python39-pillowRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:10.3.0-1.el8ap | 0:10.3.0-1.el8ap |
python39-pillow-debuginfoRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:10.3.0-1.el8ap | 0:10.3.0-1.el8ap |
python3x-pillowRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:10.3.0-1.el8ap | 0:10.3.0-1.el8ap |
python3x-pillow-debugsourceRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:10.3.0-1.el8ap | 0:10.3.0-1.el8ap |
python-pillowRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:10.3.0-1.el9ap | 0:10.3.0-1.el9ap |
python-pillow-debugsourceRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:10.3.0-1.el9ap | 0:10.3.0-1.el9ap |
python3-pillowRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:10.3.0-1.el9ap | 0:10.3.0-1.el9ap |
python3-pillow-debuginfoRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:10.3.0-1.el9ap | 0:10.3.0-1.el9ap |
python39-gunicornRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:22.0.0-1.el8ap | 0:22.0.0-1.el8ap |
python3x-gunicornRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:22.0.0-1.el8ap | 0:22.0.0-1.el8ap |
python-gunicornRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:22.0.0-1.el9ap | 0:22.0.0-1.el9ap |
python3-gunicornRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:22.0.0-1.el9ap | 0:22.0.0-1.el9ap |
python39-idnaRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.7-1.el8ap | 0:3.7-1.el8ap |
python3x-idnaRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.7-1.el8ap | 0:3.7-1.el8ap |
python39-idnaRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.7-1.el8ap | 0:3.7-1.el8ap |
python3x-idnaRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.7-1.el8ap | 0:3.7-1.el8ap |
python-idnaRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.7-1.el9ap | 0:3.7-1.el9ap |
python3-idnaRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.7-1.el9ap | 0:3.7-1.el9ap |
python-idnaRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.7-1.el9ap | 0:3.7-1.el9ap |
python3-idnaRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.7-1.el9ap | 0:3.7-1.el9ap |
python39-pydanticRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:1.10.15-1.el8ap | 0:1.10.15-1.el8ap |
python3x-pydanticRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:1.10.15-1.el8ap | 0:1.10.15-1.el8ap |
python-pydanticRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:1.10.15-1.el9ap | 0:1.10.15-1.el9ap |
python3-pydanticRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:1.10.15-1.el9ap | 0:1.10.15-1.el9ap |
python39-sqlparseRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:0.5.0-1.el8ap | 0:0.5.0-1.el8ap |
python3x-sqlparseRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:0.5.0-1.el8ap | 0:0.5.0-1.el8ap |
python-sqlparseRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:0.5.0-1.el9ap | 0:0.5.0-1.el9ap |
python3-sqlparseRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:0.5.0-1.el9ap | 0:0.5.0-1.el9ap |
python39-blackRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el8ap | 0:22.8.0-2.el8ap |
python3x-blackRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el8ap | 0:22.8.0-2.el8ap |
python39-blackRed Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el8ap | 0:22.8.0-2.el8ap |
python3x-blackRed Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el8ap | 0:22.8.0-2.el8ap |
python39-blackRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el8ap | 0:22.8.0-2.el8ap |
python3x-blackRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el8ap | 0:22.8.0-2.el8ap |
python-blackRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el9ap | 0:22.8.0-2.el9ap |
python3-blackRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el9ap | 0:22.8.0-2.el9ap |
python-blackRed Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el9ap | 0:22.8.0-2.el9ap |
python3-blackRed Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el9ap | 0:22.8.0-2.el9ap |
python-blackRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el9ap | 0:22.8.0-2.el9ap |
python3-blackRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:22.8.0-2.el9ap | 0:22.8.0-2.el9ap |
python39-aiohttpRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.9.5-1.el8ap | 0:3.9.5-1.el8ap |
python39-aiohttp-debuginfoRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.9.5-1.el8ap | 0:3.9.5-1.el8ap |
python3x-aiohttpRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.9.5-1.el8ap | 0:3.9.5-1.el8ap |
python3x-aiohttp-debugsourceRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.9.5-1.el8ap | 0:3.9.5-1.el8ap |
python-aiohttpRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.9.5-1.el9ap | 0:3.9.5-1.el9ap |
python-aiohttp-debugsourceRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.9.5-1.el9ap | 0:3.9.5-1.el9ap |
python3-aiohttpRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.9.5-1.el9ap | 0:3.9.5-1.el9ap |
python3-aiohttp-debuginfoRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.9.5-1.el9ap | 0:3.9.5-1.el9ap |
automation-hubRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:4.9.2-1.el8ap | 0:4.9.2-1.el8ap |
python39-galaxy-ngRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:4.9.2-1.el8ap | 0:4.9.2-1.el8ap |
python3x-galaxy-ngRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:4.9.2-1.el8ap | 0:4.9.2-1.el8ap |
automation-hubRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:4.9.2-1.el9ap | 0:4.9.2-1.el9ap |
python-galaxy-ngRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:4.9.2-1.el9ap | 0:4.9.2-1.el9ap |
python3-galaxy-ngRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:4.9.2-1.el9ap | 0:4.9.2-1.el9ap |
python39-social-auth-app-djangoRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:5.4.1-1.el8ap | 0:5.4.1-1.el8ap |
python3x-social-auth-app-djangoRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:5.4.1-1.el8ap | 0:5.4.1-1.el8ap |
python-social-auth-app-djangoRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:5.4.1-1.el9ap | 0:5.4.1-1.el9ap |
python3-social-auth-app-djangoRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:5.4.1-1.el9ap | 0:5.4.1-1.el9ap |
python39-jinja2Red Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el8ap | 0:3.1.4-1.el8ap |
python3x-jinja2Red Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el8ap | 0:3.1.4-1.el8ap |
python39-jinja2Red Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el8ap | 0:3.1.4-1.el8ap |
python3x-jinja2Red Hat:ansible_automation_platform_inside:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el8ap | 0:3.1.4-1.el8ap |
python39-jinja2Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el8ap | 0:3.1.4-1.el8ap |
python3x-jinja2Red Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el8ap | 0:3.1.4-1.el8ap |
python-jinja2Red Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el9ap | 0:3.1.4-1.el9ap |
python3-jinja2Red Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el9ap | 0:3.1.4-1.el9ap |
python-jinja2Red Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el9ap | 0:3.1.4-1.el9ap |
python3-jinja2Red Hat:ansible_automation_platform_inside:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el9ap | 0:3.1.4-1.el9ap |
python-jinja2Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el9ap | 0:3.1.4-1.el9ap |
python3-jinja2Red Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:3.1.4-1.el9ap | 0:3.1.4-1.el9ap |
python39-requestsRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:2.32.2-1.el8ap | 0:2.32.2-1.el8ap |
python3x-requestsRed Hat:ansible_automation_platform_developer:2.4::el8 From an advisory covering 20 CVEs |
before 0:2.32.2-1.el8ap | 0:2.32.2-1.el8ap |
python39-requestsRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:2.32.2-1.el8ap | 0:2.32.2-1.el8ap |
python3x-requestsRed Hat:ansible_automation_platform:2.4::el8 From an advisory covering 20 CVEs |
before 0:2.32.2-1.el8ap | 0:2.32.2-1.el8ap |
python-requestsRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:2.32.2-1.el9ap | 0:2.32.2-1.el9ap |
python3-requestsRed Hat:ansible_automation_platform_developer:2.4::el9 From an advisory covering 20 CVEs |
before 0:2.32.2-1.el9ap | 0:2.32.2-1.el9ap |
python-requestsRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:2.32.2-1.el9ap | 0:2.32.2-1.el9ap |
python3-requestsRed Hat:ansible_automation_platform:2.4::el9 From an advisory covering 20 CVEs |
before 0:2.32.2-1.el9ap | 0:2.32.2-1.el9ap |
rootio-blackRoot:PyPI |
before 23.12.1+root.io.2 | 23.12.1+root.io.223.10.0+root.io.223.3.0+root.io.223.1a1+root.io.223.9.1+root.io.223.12.0+root.io.223.1.0+root.io.223.11.0+root.io.223.7.0+root.io.223.10.1+root.io.223.9.0+root.io.2 |
python-blackopenSUSE:Leap 15.6 |
before 24.3.0-150400.9.8.1 | 24.3.0-150400.9.8.1 |
blackUbuntu:20.04:LTS |
All versions, plus listed versions 19.3b0-1 |
None known |
blackUbuntu:22.04:LTS |
All versions, plus listed versions 20.8b1-421.4b2-321.10b0-121.12b0-1 |
None known |
blackUbuntu:24.04:LTS |
All versions, plus listed versions 23.7.0-123.10.1-123.11.0-124.2.0-1ubuntu1 |
None known |
blackUbuntu:25.10 |
All versions, plus listed versions 25.1.0-225.1.0-3 |
None known |
blackUbuntu:26.10 |
All versions, plus listed versions 26.3.1-126.5.1-1 |
None known |
blackUbuntu:26.04:LTS |
All versions, plus listed versions 25.1.0-325.9.0-125.11.0-125.12.0-126.1.0-126.1.0-1build126.3.1-1 |
None known |
python-blackopenSUSE:Tumbleweed |
before 26.5.1-1.3 | 26.5.1-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-21503 is a medium vulnerability (CVSS 5.3) in Psf Black, published March 19, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in black 24.3.0.
References
security.snyk.io/vuln/SNYK-PYTHON-BLACK-6256273
github.com/psf/black/releases/tag/24.3.0
nvd.nist.gov/vuln/detail/CVE-2024-21503
Show 125 moreShow less
security.alpinelinux.org/vuln/CVE-2024-21503
security-tracker.debian.org/tracker/CVE-2024-21503
access.redhat.com/errata/RHSA-2024:3781
bugzilla.redhat.com/show_bug.cgi?id=2250765
issues.redhat.com/browse/AAH-3111
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3781.json
cve.org/CVERecord?id=CVE-2023-5752
mail.python.org/archives/list/[email protected]/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL
nowotarski.info/http2-continuation-flood
pkg.go.dev/vuln/GO-2024-2687
kb.cert.org/vuls/id/421644
openwall.com/lists/oss-security/2024/03/08/4
go.dev/cl/569341
groups.google.com/g/golang-announce/c/5pwGVUPoMbg
security.netapp.com/advisory/ntap-20240329-0004
devhub.checkmarx.com/cve-details/CVE-2023-50447
duartecsantos.github.io/2023-01-02-CVE-2023-50447
huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
djangoproject.com/weblog/2024/mar/04/security-releases
suse.com/support/update/announcement/2024/suse-su-20242481-1
bugzilla.suse.com/1221530
ubuntu.com/security/CVE-2024-21503
This page doesn't list everything
Left out here: 7 versions. The JSON record has them.