PT-2023-9227 · Python+13 · Cpython+13
Ee Durbin
·
Published
2023-09-25
·
Updated
2025-08-11
·
CVE-2024-0450
CVSS v3.1
6.2
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
CPython versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior
Description
The CPython
zipfile module is vulnerable to “quoted-overlap” zip-bombs, which exploit the zip format to create a zip-bomb with a high compression ratio. This issue can be exploited to cause a denial of service condition by persuading a victim to open a specially crafted ZIP file. The fixed versions of CPython make the zipfile module reject zip archives that overlap entries in the archive.Recommendations
For versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior, update to a version that includes the fix for the
zipfile module vulnerability.
As a temporary workaround, consider disabling the zipfile module until a patch is available.
Restrict access to the zipfile module to minimize the risk of exploitation.
Avoid using the zipfile module to open untrusted ZIP files until the issue is resolved.Fix
DoS
Improper Resource Release
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Cpython
Centos
Debian
Ibm Aix
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Zvirt Node