CVE-2024-0450
Quoted zip-bomb protection for zipfile
Résumé
Quoted zip-bomb protection for zipfile
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2024-0450 pypy3 Corrigé dans: 7.3.5+dfsg-2+deb11u3
- Ubuntu UBUNTU-CVE-2024-0450 python3.5 Corrigé dans: 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
Références
- advisory github.com
- advisory mail.python.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- package github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- report github.com
- web openwall.com
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web bamsoftware.com