CVE-2024-0450
Quoted zip-bomb protection for zipfile
概要
Quoted zip-bomb protection for zipfile
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2024-0450 pypy3 修正版: 7.3.5+dfsg-2+deb11u3
- Ubuntu UBUNTU-CVE-2024-0450 python3.5 修正版: 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
参照URL
- advisory github.com
- advisory mail.python.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- package github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- report github.com
- web openwall.com
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web bamsoftware.com