CVE-2024-0450
Quoted zip-bomb protection for zipfile
Summary
Quoted zip-bomb protection for zipfile
Original description
The description as published by the source.
An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-0450 pypy3 Fixed in: 7.3.5+dfsg-2+deb11u3
- Ubuntu UBUNTU-CVE-2024-0450 python3.5 Fixed in: 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
References
- advisory github.com
- advisory mail.python.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- package github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- report github.com
- web openwall.com
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web bamsoftware.com