PT-2025-41152 · Python+9 · Python+9

Caleb Brown + 2 · Publicado 2025-07-28 · Atualizado 2026-04-29 · CVE-2025-8291

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Python versions prior to 2.3

Description The 'zipfile' module does not validate the ZIP64 End of Central Directory (EOCD) Locator record offset value, leading to potential discrepancies in how ZIP archives are handled compared to other ZIP implementations. Specifically, the module incorrectly assumes the ZIP64 EOCD record's location, potentially allowing crafted ZIP archives to be processed in an unexpected manner.

Recommendations Update to version 2.3 or later.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-1285

Identificadores relacionados

ALSA-2025:23323

ALSA-2025:23342

ALSA-2025:23530

ALSA-2025:23940

ALSA-2026:0123

AZL-68318

AZL-68321

BDU:2026-00313

BIT-LIBPYTHON-2025-8291

BIT-PYTHON-2025-8291

BIT-PYTHON-MIN-2025-8291

CVE-2025-8291

DLA-4354-1

ECHO-37A0-326B-4E55

GHSA-HHV7-P4PG-WM6P

OESA-2025-2574

OESA-2025-2575

OESA-2025-2576

OESA-2025-2577

OESA-2025-2578

OPENSUSE-SU-2025:15713-1

OPENSUSE-SU-2025:15742-1

OPENSUSE-SU-2025:15748-1

OPENSUSE-SU-2025:15750-1

OPENSUSE-SU-2025:15760-1

OPENSUSE-SU-2025:15768-1

OPENSUSE-SU-2025:15792-1

OPENSUSE-SU-2026:20081-1

PSF-2025-12

RHSA-2025:23323

RHSA-2025:23940

RHSA-2026:0123

RHSA-2026:0353

RHSA-2026:0354

RHSA-2026:0355

RHSA-2026:7443

RHSA-2026:7661

RHSA-2026:8822

RHSA-2026:8824

SUSE-SU-2025:21199-1

SUSE-SU-2025:21207-1

SUSE-SU-2025:4221-1

SUSE-SU-2025:4257-1

SUSE-SU-2025:4257-2

SUSE-SU-2025:4258-1

SUSE-SU-2025:4277-1

SUSE-SU-2025:4297-1

SUSE-SU-2025:4313-1

SUSE-SU-2025:4352-1

SUSE-SU-2025:4368-1

SUSE-SU-2025:4389-1

SUSE-SU-2025:4398-1

SUSE-SU-2025:4487-1

SUSE-SU-2026:0133-1

SUSE-SU-2026:20125-1

SUSE-SU-2026:20154-1

USN-7886-1

USN-7886-2

Produtos afetados

Almalinux

Centos

Debian

Linuxmint

Python

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Referências · 203

• 🔥 https://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6p · Exploit
• https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6 · Correção
• https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267 · Correção
• https://github.com/python/cpython/issues/139700 · Nota
• https://github.com/python/cpython/pull/139702 · Correção
• https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4 · Correção
• https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46 · Correção
• https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388 · Correção
• https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196 · Correção
• https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3 · Correção
• https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.json · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2025:15760-1 · Aviso do Fabricante
• https://bugzilla.redhat.com/2366509 · Nota
• https://twitter.com/Cezar_H_Linux/status/1999203332783555001 · Publicação no Twitter
• https://osv.dev/vulnerability/AZL-68321 · Aviso do Fabricante