High Compression Ratio Zip-Bomb Vulnerability in CPython zipfile Module
Summary
CVE-2024-0450: An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. Affects python3 across 8 version ranges.
< 3.10.14-r0
< 30fe5d853b56138dbec62432d370a1f99409fc85
< 66363b9a7b9fe7c99eba3a185b74c5fdbf842eba
< 70497218351ba44bffc8b571201ecb5652d84675
< a2c59992e9e8d35baba9695eb186ad6c6ff85c51
< a956e510f6336d5ae111ba429a61c3ade30a7549
< d05bac0b74153beb541b88b4fca33bf053990183
< fa181fcf2156f703347b03a3b1966ce47be8ab3b
Fixed in 3.10.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The CPython zipfile module is a built-in module in the Python programming language that provides tools for creating, reading, and extracting ZIP archives. It is widely used for tasks such as file compression and packaging. However, versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior are vulnerable to a high compression ratio zip-bomb attack known as 'quoted-overlap'. This vulnerability allows an attacker to create a malicious ZIP archive that can consume excessive system resources when extracted, potentially leading to denial-of-service (DoS) conditions.
Vulnerability Detail
The 'quoted-overlap' zip-bomb vulnerability in the CPython zipfile module arises from a flaw in the handling of overlapping entries in ZIP archives. By exploiting this vulnerability, an attacker can create a ZIP archive that appears to have a small size but expands to an enormous size when extracted. This can overwhelm the system's resources, causing performance degradation or even crashing the system. The fixed versions of CPython address this issue by rejecting zip archives that contain overlapping entries.
How To Fix
Minimum fixed version
3.10.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed versions of CPython to ensure the security and stability of the system.
Conclusion
The 'quoted-overlap' zip-bomb vulnerability in the CPython zipfile module can be mitigated by updating to the fixed versions of CPython. It is crucial to keep software up to date to ensure the security and stability of systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3 →
FAQ
This vulnerability can be exploited to create zip-bombs that consume excessive system resources when extracted, potentially leading to denial-of-service conditions.
Yes, versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior are vulnerable to this zip-bomb attack.
No, this vulnerability requires the attacker to provide a malicious ZIP archive for extraction on the target system.
At the time of this report, there is no known public exploit for this vulnerability.
It is strongly advised to update to the fixed versions of CPython to mitigate the risk of this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for python3.
