Moderate Security Update for Python 3.12: Addressing Zipfile EOCD Locator Vulnerability
Summary
ALSA-2025:23323: Moderate: python3.12 security update. Affects python3.12 versions < 3.12.12-1.el9_7. Fixed in 3.12.12-1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, and dynamic data types. It provides interfaces to various system calls and libraries, making it a versatile choice for developers. However, it has been identified that the zipfile module in Python 3.12 is vulnerable to a security issue where the End of Central Directory (EOCD) Locator record offset is not properly checked, potentially leading to security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2025-8291, arises from the lack of validation of the EOCD Locator record offset in the zipfile module of Python 3.12. This oversight can be exploited by attackers to manipulate zip files, potentially leading to arbitrary code execution or data corruption. The implications of this vulnerability are significant, as it could compromise the integrity and security of applications relying on Python's zipfile functionality.
How To Fix
Minimum fixed version
3.12.12-1.el9_7
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the zipfile module for untrusted zip files until the update is applied. Additionally, consider implementing file validation checks before processing zip files to mitigate potential risks.
Conclusion
The vulnerability CVE-2025-8291 in Python 3.12's zipfile module poses significant security risks due to improper handling of zip file structures. It is essential to update to the patched version 3.12.12-1.el9_7 to ensure the security of applications. In the meantime, implementing workarounds can help mitigate potential threats.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2025-8291 is a vulnerability in Python 3.12's zipfile module that allows for improper handling of the End of Central Directory Locator record offset, potentially leading to security issues.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential arbitrary code execution and data corruption, which can compromise the security and integrity of applications using the affected Python version.
Yes, a patch is available in version 3.12.12-1.el9_7 of Python 3.12. It is crucial to update to this version to mitigate the vulnerability.
If immediate updating is not possible, avoid using the zipfile module for untrusted zip files and implement additional validation checks on files before processing.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
