Moderate Security Update for Python 3.12: Addressing Zipfile EOCD Locator Vulnerability
Summary
ALSA-2025:23940: Moderate: python3.12 security update. Affects python-unversioned-command versions < 3.12.12-1.el10_1. Fixed in 3.12.12-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various programming paradigms and is equipped with extensive libraries and frameworks. The affected package, Python 3.12, includes critical features for developers, such as modules, classes, and dynamic data types, making it a cornerstone for many applications. However, it is susceptible to vulnerabilities that can compromise the integrity and security of applications built using this language.
Vulnerability Detail
The vulnerability identified as CVE-2025-8291 pertains to the Python zipfile module, specifically an oversight in checking the End of Central Directory (EOCD) Locator record offset. This flaw could allow an attacker to exploit the zipfile handling functionality, potentially leading to arbitrary code execution or data corruption. The vulnerability arises from insufficient validation of the EOCD record, which is crucial for the correct extraction of zip files. If exploited, this could have severe implications for applications relying on zipfile operations, making it imperative for users to address this issue promptly.
How To Fix
Minimum fixed version
3.12.12-1.el10_1
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the zipfile module for untrusted zip files until the update is applied. It is advisable to validate and sanitize any zip files before processing them in applications.
Conclusion
The vulnerability CVE-2025-8291 in Python 3.12 highlights a critical oversight in the zipfile module that could lead to severe security risks. Users are strongly encouraged to update their packages to the patched version to safeguard their applications. For those unable to update immediately, implementing workarounds can help mitigate potential threats.
See every vulnerability recorded for python-unversioned-command →
FAQ
CVE-2025-8291 is a vulnerability in Python's zipfile module that allows for potential exploitation due to insufficient validation of the EOCD Locator record.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to arbitrary code execution or data corruption, posing significant risks to applications that utilize the zipfile functionality.
Yes, a patch is available in version 3.12.12-1.el10_1 of Python. Users should update to this version to mitigate the risk.
If immediate updating is not possible, refrain from using the zipfile module with untrusted zip files and validate any zip files before processing.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
