CVE-2024-8088

CVSS V2 None CVSS V3 None
Description
There is a HIGH severity vulnerability affecting the CPython "zipfile" module. When iterating over names of entries in a zip archive (for example, methods of "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
Overview
  • CVE ID
  • CVE-2024-8088
  • Assigner
  • PSF
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-08-22T18:45:31.807Z
  • Last Modified Date
  • 2024-08-23T00:09:14.061Z
Weakness Enumerations
CWE URL
CWE-835 http://cwe.mitre.org/data/definitions/835.html
References
Reference URL Reference Tags
https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/ vendor-advisory
https://github.com/python/cpython/pull/122906 patch
https://github.com/python/cpython/issues/122905 issue-tracking
https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e patch
https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64 patch
https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea patch
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-8088
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8088
History
Created Old Value New Value Data Type Notes
2024-08-23 13:02:47 Added to TrackCVE