Description
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Python Software Foundation CPython
Default version status: unaffected
0 to < 3.8.20affected3.9.0 to < 3.9.20affected3.10.0 to < 3.10.15affected3.11.0 to < 3.11.10affected3.12.0 to < 3.12.6affected3.13.0a1 to < 3.13.0rc2affected
References
- https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/ ↗
- https://github.com/python/cpython/pull/122906 ↗
- https://github.com/python/cpython/issues/122905 ↗
- https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e ↗
- https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64 ↗
- https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea ↗
- https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db ↗
- https://github.com/python/cpython/issues/123270 ↗
- https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6 ↗
- https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4 ↗
- https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a ↗
- https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814 ↗
- https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7 ↗
- https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798 ↗
- https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1 ↗
- https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932 ↗
- http://www.openwall.com/lists/oss-security/2024/08/22/1 ↗
- http://www.openwall.com/lists/oss-security/2024/08/22/4 ↗
- http://www.openwall.com/lists/oss-security/2024/08/23/1 ↗
- http://www.openwall.com/lists/oss-security/2024/08/23/2 ↗
- https://security.netapp.com/advisory/ntap-20241011-0010/ ↗
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html ↗