Denial of Service Vulnerability in Python's zipfile Module
Summary
CVE-2019-9674: Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. Affects python2.7 versions < 9a3ffc0492d1310ead9ce8f5ee678c26b20a338d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a popular programming language known for its simplicity and versatility. It provides a standard library that includes various modules for different functionalities. One such module is 'zipfile', which allows users to work with ZIP archives. This vulnerability affects Python versions up to 3.7.2 and can be exploited remotely to cause a denial of service (DoS) attack by consuming excessive system resources. The vulnerability resides in the 'Lib/zipfile.py' file.
Vulnerability Detail
The vulnerability, identified as CVE-2019-9674, originates from the way Python's 'zipfile' module handles ZIP archives. By crafting a malicious ZIP bomb, an attacker can trigger resource exhaustion on the target system. This can lead to system instability, unresponsiveness, or even a complete system crash. The severity of this vulnerability is rated as 'High' with a CVSS score of 7.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can implement input validation and limit the size of ZIP archives processed by the 'zipfile' module. By setting a reasonable threshold for the maximum allowed size, the risk of resource exhaustion can be reduced. Here is an example of how to limit the size of a ZIP archive in Python:
import zipfile
def extract_zip(file_path):
max_size = 1024 * 1024 # Maximum allowed size in bytes
with zipfile.ZipFile(file_path) as zip_file:
if zip_file.infolist()[0].file_size > max_size:
raise ValueError('ZIP archive exceeds the maximum allowed size')
zip_file.extractall()
In this example, the 'extract_zip' function checks the size of the first file in the ZIP archive and raises an exception if it exceeds the specified threshold.
Conclusion
The vulnerability in Python's 'zipfile' module allows remote attackers to cause a denial of service (DoS) by exploiting a ZIP bomb. It is crucial to update Python to a version beyond 3.7.2 to mitigate this vulnerability. Implementing input validation and size limitations for ZIP archives can serve as a temporary workaround. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python2.7 →
FAQ
This vulnerability can be exploited remotely to cause a denial of service (DoS) attack by consuming excessive system resources. It can lead to system instability, unresponsiveness, or even a complete system crash.
Python versions up to 3.7.2 are affected by this vulnerability.
Yes, the Python development team has addressed this vulnerability in subsequent releases. Users should upgrade to a version beyond 3.7.2 to ensure the vulnerability is mitigated.
Yes, users can implement input validation and limit the size of ZIP archives processed by the 'zipfile' module. By setting a reasonable threshold for the maximum allowed size, the risk of resource exhaustion can be reduced.
The CVSS score of this vulnerability is 7.5, indicating a 'High' severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
