PT-2024-5225 · Python+5 · Cpython+5
Published
2024-07-08
·
Updated
2026-01-19
·
CVE-2024-5569
CVSS v4.0
6.9
Medium
| Vector | AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions:
jaraco/zipp versions prior to 3.19.1
Description:
A Denial of Service (DoS) issue exists in the jaraco/zipp library, triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the
Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding.Recommendations:
For versions prior to 3.19.1, update to version 3.19.1 or later to resolve the issue.
As a temporary workaround, consider avoiding the use of functions affecting the
Path module, such as joinpath, the overloaded division operator, and iterdir, when processing zip files until a patch is available.Fix
DoS
Infinite Loop
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cpython
Debian
Linuxmint
Red Os
Suse
Ubuntu