Critical Denial of Service Vulnerability in Python Packages: CVE-2019-9674
Summary
UBUNTU-CVE-2019-9674: Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm6. Fixed in 2.7.6-8ubuntu0.6+esm6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It is utilized in various applications ranging from web development to data analysis. The affected packages, including python2.7, python3.4, python3.5, python3.6, and python3.7, are essential components of the Python ecosystem, providing core functionalities and libraries for developers. This vulnerability exposes these packages to potential denial of service attacks, which can severely impact application availability.
Vulnerability Detail
The vulnerability, identified as CVE-2019-9674, resides in the Lib/zipfile.py module of Python versions up to 3.7.2. It allows remote attackers to exploit ZIP bombs, which are maliciously crafted ZIP files designed to consume excessive system resources upon extraction. This can lead to denial of service, rendering applications unresponsive and potentially crashing systems. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted ZIP files or implement strict validation checks on ZIP file contents to mitigate the risk of ZIP bomb attacks.
Conclusion
CVE-2019-9674 is a critical vulnerability affecting multiple Python packages, allowing for denial of service through ZIP bomb exploitation. It is essential to update to the patched versions to safeguard applications and maintain system integrity.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2019-9674 is a vulnerability in Python's zipfile module that allows attackers to exploit ZIP bombs, leading to denial of service.
The vulnerability affects Python versions up to 3.7.2, including packages like python2.7, python3.4, python3.5, python3.6, and python3.7.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploiting this vulnerability can lead to denial of service, causing applications to become unresponsive and potentially crashing systems.
You can update your Python packages using the command: sudo apt-get install <package_name>=<patched_version>.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
