Skip to content
fr Sign in
6.2 Medium

CVE-2024-0450 An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and…

Description

An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.

Affected products and versions

Product Affected versions Fixed in
cpython 3.12.1 No fix stated
cpython 3.11.7 No fix stated
cpython 3.10.13 No fix stated
cpython 3.9.18 No fix stated
cpython 3.8 earliest → < 3.8.18 3.8.18
CPython 3.13 3.13.0a1 → < 3.13.0a3 3.13.0a3
CPython 3.12 3.12.0 → < 3.12.2 3.12.2
CPython 3.11 3.11.0 → < 3.11.8 3.11.8
CPython 3.10 3.10.0 → < 3.10.14 3.10.14
Show the 2 other branches
Product Affected versions Fixed in
CPython 3.9 3.9.0 → < 3.9.19 3.9.19
CPython 3.8 earliest → < 3.8.19 3.8.19

References

Timeline

  1. Published
  2. Last modified

Other CVEs of cpython

The 8 CVEs of cpython →
CVE-2024-9287 A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual… 5.3 Medium CVE-2024-6232 There is a MEDIUM severity vulnerability affecting CPython 7.5 High CVE-2024-7592 There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module 7.5 High CVE-2024-6923 There is a MEDIUM severity vulnerability affecting CPython 5.5 Medium
Track this CVE