CVE-2024-0450: Quoted zip-bomb protection for zipfile
An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
Other sources
Python CPython is vulnerable to a denial of service, caused by improper input validation by the zipfile module. By persuading a victim to open a specially crafted ZIP file, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/pypy3to a version that resolves this vulnerability.Fixed in 7.3.5+dfsg-2+deb11u4Fixed in 7.3.11+dfsg-2+deb12u3Fixed in 7.3.19+dfsg-2 - Upgrade
Upgrade
debian/python3.11to a version that resolves this vulnerability.Fixed in 3.11.2-6+deb12u5Fixed in 3.11.2-6+deb12u3 - Upgrade
Upgrade
debian/python3.12to a version that resolves this vulnerability.Fixed in 3.12.10-1 - Upgrade
Upgrade
debian/python3.9to a version that resolves this vulnerability.Fixed in 3.9.2-1+deb11u3 - Upgrade
Upgrade
python/cpython (zipfile module)to a version that resolves this vulnerability.Fixed in 3.10.14Patch CVE-2023-6597 - Upgrade
Upgrade
python/cpython (zipfile module)to a version that resolves this vulnerability.Fixed in 3.9.19Patch CVE-2024-0450 - Upgrade
Upgrade
python/cpython (zipfile module)to a version that resolves this vulnerability.Fixed in 3.8.19Patch CVE-2024-0450
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0450?
CVE-2024-0450 is considered a moderate severity vulnerability due to its potential to create zip-bombs.
How do I fix CVE-2024-0450?
To fix CVE-2024-0450, upgrade to a patched version of the CPython zipfile module or update your Python installation to a secure version.
Which versions of Python are affected by CVE-2024-0450?
CVE-2024-0450 affects CPython versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18, along with earlier versions.
What are the potential impacts of CVE-2024-0450?
The vulnerability can allow attackers to create zip-bombs that may exhaust system resources when processed.
Is there a specific mitigation strategy for CVE-2024-0450?
The primary mitigation for CVE-2024-0450 is ensuring that you are running a version of Python that has addressed the vulnerability.