python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data before the first or after the last boundary, causing high CPU load and stalling the processing thread for a significant amount of time. In case of ASGI application, this could stall the event loop and prevent other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed in 0.0.18.

The remote Ubuntu 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8027-1 advisory.

    It was discovered that Python-Multipart incorrectly handled certain

    regular expressions. An attacker could possibly use this issue to cause Python-Multipart to consume     excessive resources, leading to a regular

    expression denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2024-24762)

    It was discovered that Python-Multipart did not properly sanitize line breaks during user input. An     attacker could use this issue to send

    arbitrary input, thus preventing other requests from being processed,

    resulting in a denial of service. This issue was only fixed in

    Ubuntu 24.04 LTS. (CVE-2024-53981)

    It was discovered that Python-Multipart was vulnerable to path traversal attacks. An attacker could     possibly craft and upload files outside the

    target directory, resulting in remote code execution. (CVE-2026-24486)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart     skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last     boundary. This happens one byte at a time and emits a log event each time, which may cause excessive     logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data     before the first or after the last boundary, causing high CPU load and stalling the processing thread for     a significant amount of time. In case of ASGI application, this could stall the event loop and prevent     other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed     in 0.0.18. (CVE-2024-53981)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1083 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-53981:
    python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart     skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the last     boundary. This happens one byte at a time and emits a log event each time, which may cause excessive     logging for certain inputs. An attacker could abuse this by sending a malicious request with lots of data     before the first or after the last boundary, causing high CPU load and stalling the processing thread for     a significant amount of time. In case of ASGI application, this could stall the event loop and prevent     other requests from being processed, resulting in a denial of service (DoS). This vulnerability is fixed     in 0.0.18.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2024:4194-1 advisory.

    - CVE-2024-53981: excessive logging for certain inputs when parsing form data. (bsc#1234115)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-92de63698e advisory.

    Security update for CVE-2024-53981.

    ## 0.0.19 (2024-11-30)

    * Don't warn when CRLF is found after last boundary on `MultipartParser`.

    ## 0.0.18 (2024-11-28)

    * Hard break if found data after last boundary on `MultipartParser`.



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-ab8945c2bd advisory.

    Security update for CVE-2024-53981.

    ## 0.0.19 (2024-11-30)

    * Don't warn when CRLF is found after last boundary on `MultipartParser`.

    ## 0.0.18 (2024-11-28)

    * Hard break if found data after last boundary on `MultipartParser`.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
298807	Ubuntu 22.04 LTS / 24.04 LTS : Python-Multipart vulnerabilities (USN-8027-1)	Nessus	Ubuntu Local Security Checks	high
259676	Linux Distros Unpatched Vulnerability : CVE-2024-53981	Nessus	Misc.	high
239073	TencentOS Server 4: python-multipart (TSSA-2024:1083)	Nessus	Tencent Local Security Checks	high
212312	openSUSE 15 Security Update : python-python-multipart (SUSE-SU-2024:4194-1)	Nessus	SuSE Local Security Checks	high
212210	Fedora 41 : python-python-multipart (2024-92de63698e)	Nessus	Fedora Local Security Checks	high
212209	Fedora 40 : python-multipart (2024-ab8945c2bd)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2024-53981

high

Tenable Plugins

high

high

high

high

high

high