diff --git a/0001-fix-cve-CVE-2024-6232.patch b/0001-fix-cve-CVE-2024-6232.patch
new file mode 100644
index 0000000000000000000000000000000000000000..6dd178b59598bf04d6fc0e9818b99bf22fc13b2b
--- /dev/null
+++ b/0001-fix-cve-CVE-2024-6232.patch
@@ -0,0 +1,74 @@
+From fa705003ad88f9043f6f055d867c996b1e98cb80 Mon Sep 17 00:00:00 2001
+From: zhuhongbo <zhuhongbo@uniontech.com>
+Date: Mon, 17 Mar 2025 16:38:49 +0800
+Subject: [PATCH] fix cve CVE-2024-6232
+
+---
+ Lib/test/test_tarfile.py                      | 41 +++++++++++++++++++
+ ...-07-02-13-39-20.gh-issue-121285.hrl-yI.rst |  2 +
+ 2 files changed, 43 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.hrl-yI.rst
+
+diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
+index cc86288..2a9ee2b 100644
+--- a/Lib/test/test_tarfile.py
++++ b/Lib/test/test_tarfile.py
+@@ -1041,6 +1041,47 @@ class PaxReadTest(LongnameTest, ReadTest, unittest.TestCase):
+         finally:
+             tar.close()
+ 
++    def test_pax_header_bad_formats(self):
++        # The fields from the pax header have priority over the
++        # TarInfo.
++        pax_header_replacements = (
++            b" foo=bar\n",
++            b"0 \n",
++            b"1 \n",
++            b"2 \n",
++            b"3 =\n",
++            b"4 =a\n",
++            b"1000000 foo=bar\n",
++            b"0 foo=bar\n",
++            b"-12 foo=bar\n",
++            b"000000000000000000000000036 foo=bar\n",
++        )
++        pax_headers = {"foo": "bar"}
++
++        for replacement in pax_header_replacements:
++            with self.subTest(header=replacement):
++                tar = tarfile.open(tmpname, "w", format=tarfile.PAX_FORMAT,
++                                   encoding="iso8859-1")
++                try:
++                    t = tarfile.TarInfo()
++                    t.name = "pax"  # non-ASCII
++                    t.uid = 1
++                    t.pax_headers = pax_headers
++                    tar.addfile(t)
++                finally:
++                    tar.close()
++
++                with open(tmpname, "rb") as f:
++                    data = f.read()
++                    self.assertIn(b"11 foo=bar\n", data)
++                    data = data.replace(b"11 foo=bar\n", replacement)
++
++                with open(tmpname, "wb") as f:
++                    f.truncate()
++                    f.write(data)
++
++                with self.assertRaisesRegex(tarfile.ReadError, r"file could not be opened successfully"):
++                    tarfile.open(tmpname, encoding="iso8859-1")
+ 
+ class WriteTestBase(TarTest):
+     # Put all write tests in here that are supposed to be tested
+diff --git a/Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.hrl-yI.rst b/Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.hrl-yI.rst
+new file mode 100644
+index 0000000..81f918b
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.hrl-yI.rst
+@@ -0,0 +1,2 @@
++Remove backtracking from tarfile header parsing for ``hdrcharset``, PAX, and
++GNU sparse headers.
+-- 
+2.39.3
+
diff --git a/python3.spec b/python3.spec
index c1c3bf11c67ce02347d4979afc6ec80dc5bf2fa2..6c64fad72d44881a4084d2badcdd099f6971ce4a 100644
--- a/python3.spec
+++ b/python3.spec
@@ -14,7 +14,7 @@ URL: https://www.python.org/
 #  WARNING  When rebasing to a new Python version,
 #           remember to update the python3-docs package as well
 Version: %{pybasever}.8
-Release: 21%{?dist}
+Release: 21%{?dist}.1
 License: Python
 
 
@@ -518,6 +518,8 @@ Patch399: 00399-CVE-2023-24329.patch
 # Backported from Python 3.8
 Patch404: 00404-cve-2023-40217.patch
 
+#add by uos
+Patch405: 0001-fix-cve-CVE-2024-6232.patch
 # (New patches go here ^^^)
 #
 # When adding new patches to "python" and "python3" in Fedora, EL, etc.,
@@ -850,6 +852,7 @@ git apply %{PATCH351}
 %patch378 -p1
 %patch399 -p1
 %patch404 -p1
+%patch405 -p1
 
 # Remove files that should be generated by the build
 # (This is after patching, so that we can use patches directly from upstream)
@@ -1723,6 +1726,9 @@ CheckPython optimized
 # ======================================================
 
 %changelog
+* Mon Mar 10 2025 zhuhongbo <zhuhongbo@uniontech.com> - 3.6.8-21.1 
+- cve: fix cve CVE-2024-6232
+
 * Tue Oct 24 2023 Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-21
 - Test fixups for CVE-2023-40217
 Resolves: RHEL-3139