Critical Vulnerability in Python3 Zipfile Module: Quoted-Overlap Zip-Bombs
Summary
ALPINE-CVE-2024-0450: An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. Affects python3 versions < 3.10.14-r0. Fixed in 3.10.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python3 is a widely-used programming language known for its simplicity and versatility. The zipfile module in Python allows for the creation, reading, writing, and manipulation of ZIP archives. However, certain versions of this module are vulnerable to a specific type of attack known as 'quoted-overlap' zip-bombs, which can exploit the ZIP format to create highly compressed malicious files.
Vulnerability Detail
The vulnerability arises from the zipfile module in CPython versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and earlier. It allows attackers to create zip-bombs that can overwhelm systems by exploiting overlapping entries in ZIP archives. This can lead to denial of service or other malicious outcomes, as the system may attempt to decompress an excessively large file that consumes resources.
How To Fix
Minimum fixed version
3.10.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted ZIP files or implement additional validation checks on ZIP archives before extraction to mitigate the risk of encountering zip-bombs.
Conclusion
The vulnerability in the Python3 zipfile module poses significant risks, particularly through the exploitation of zip-bombs. It is crucial for users to update to the patched versions to safeguard their systems. Additionally, employing Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for python3 →
FAQ
A zip-bomb is a malicious ZIP file designed to crash or disrupt the system by consuming excessive resources when decompressed.
The affected versions include CPython 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability can lead to denial of service, system crashes, or other malicious activities due to resource exhaustion.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
