Infinite loop when iterating over zip archive entry names from zipfile.Path
Résumé
Infinite loop when iterating over zip archive entry names from zipfile.Path
Description d'origine
La description telle que publiée par la source (souvent en anglais).
There is a HIGH severity vulnerability affecting the CPython "zipfile"
module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected.
When iterating over names of entries in a zip archive (for example, methods
of "zipfile.Path" like "namelist()", "iterdir()", etc)
the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2024-8088 python3 Corrigé dans: 3.10.14-r2
- Debian DEBIAN-CVE-2024-8088 pypy3
- Ubuntu UBUNTU-CVE-2024-8088 python3.8
Références
- advisory github.com
- advisory mail.python.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- package github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com
- report github.com
- report github.com
- web openwall.com
- web openwall.com
- web openwall.com
- web openwall.com
- web lists.debian.org