REDHAT-BUG-2276525: Medium severity Python CPython vulnerability
An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
https://github.com/python/cpython/commit/30fe5d853b56138dbec62432d370a1f99409fc85 https://github.com/python/cpython/commit/66363b9a7b9fe7c99eba3a185b74c5fdbf842eba https://github.com/python/cpython/commit/a2c59992e9e8d35baba9695eb186ad6c6ff85c51 https://github.com/python/cpython/commit/a956e510f6336d5ae111ba429a61c3ade30a7549 https://github.com/python/cpython/commit/d05bac0b74153beb541b88b4fca33bf053990183 https://github.com/python/cpython/commit/fa181fcf2156f703347b03a3b1966ce47be8ab3b https://github.com/python/cpython/issues/109858 https://lists.debian.org/debian-lts-announce/2024/03/msg00024.html https://lists.debian.org/debian-lts-announce/2024/03/msg00025.html https://mail.python.org/archives/list/security-announce@python.org/thread/XELNUX2L3IOHBTFU7RQHCY6OUVEWZ2FG/ https://www.bamsoftware.com/hacks/zipbomb/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CPython zipfile moduleto a version that resolves this vulnerability.Fixed in 3.12.1 - Upgrade
Upgrade
CPython zipfile moduleto a version that resolves this vulnerability.Fixed in 3.11.7 - Upgrade
Upgrade
CPython zipfile moduleto a version that resolves this vulnerability.Fixed in 3.10.13 - Upgrade
Upgrade
CPython zipfile moduleto a version that resolves this vulnerability.Fixed in 3.9.18 - Upgrade
Upgrade
CPython zipfile moduleto a version that resolves this vulnerability.Fixed in 3.8.18
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2276525?
The severity of REDHAT-BUG-2276525 is classified as high due to the potential for exploitation through zip-bomb attacks.
How do I fix REDHAT-BUG-2276525?
To fix REDHAT-BUG-2276525, upgrade to CPython versions 3.12.2 or later, 3.11.8 or later, 3.10.14 or later, 3.9.19 or later, or 3.8.19 or later.
Which versions of CPython are affected by REDHAT-BUG-2276525?
CPython versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior are affected by REDHAT-BUG-2276525.
What types of attacks does REDHAT-BUG-2276525 enable?
REDHAT-BUG-2276525 enables 'quoted-overlap' zip-bomb attacks that exploit zip file formats to perform denial of service.
Is there a workaround for REDHAT-BUG-2276525?
The best course of action for REDHAT-BUG-2276525 is to update to a patched version as there are no effective workarounds.