CVE-2024-8088
Infinite loop when iterating over zip archive entry names from zipfile.Path
Summary
Infinite loop when iterating over zip archive entry names from zipfile.Path
Original description
The description as published by the source.
There is a HIGH severity vulnerability affecting the CPython "zipfile"
module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected.
When iterating over names of entries in a zip archive (for example, methods
of "zipfile.Path" like "namelist()", "iterdir()", etc)
the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2024-8088 python3 Fixed in: 3.10.14-r2
- Debian DEBIAN-CVE-2024-8088 pypy3
- Ubuntu UBUNTU-CVE-2024-8088 python3.8
References
- advisory github.com
- advisory mail.python.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- package github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- report github.com
- report github.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web lists.debian.org