Critical Vulnerability in Python Packages: Zipfile Module Exploitation
Summary
UBUNTU-CVE-2024-0450: An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. Affects python3.5 versions < 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1. Fixed in 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The impacted packages, including python2.7, python3.4, python3.5, python3.6, python3.7, python3.8, python3.9, and python3.10, are essential for executing Python scripts and applications. The zipfile module within these packages allows users to read and write ZIP files, making it a critical component for many applications that handle compressed data. However, a vulnerability has been identified that could allow attackers to exploit this module, leading to severe consequences.
Vulnerability Detail
An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The vulnerability, known as 'quoted-overlap' zip-bombs, exploits the zip format to create a zip-bomb with a high compression ratio. This could lead to denial of service attacks, where the application becomes unresponsive due to excessive resource consumption when processing malicious ZIP files.
How To Fix
Minimum fixed version
3.5.2-2ubuntu0~16.04.4~14.04.1+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python3.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid processing ZIP files from untrusted sources until the packages are updated. Implement input validation to check for the integrity of ZIP files before processing them.
Conclusion
The identified vulnerability in the Python zipfile module poses a significant risk to applications that handle ZIP files. It is crucial for developers and system administrators to update their Python packages to the patched versions to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for python3.5 →
FAQ
The CVSS score of the vulnerability is 6.2, indicating a medium severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to denial of service attacks, causing applications to become unresponsive when processing malicious ZIP files.
Yes, patched versions of the affected packages are available. Updating to these versions will resolve the vulnerability.
If immediate updates are not possible, avoid processing ZIP files from untrusted sources and implement input validation as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for python3.5.
