CVE-2024-8088

2024-08-2200:00:00

ubuntu.com

cpython

zipfile module

high severity

CVSS4

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/SC:N/VI:N/SI:N/VA:H/SA:N/S:N/AU:N/R:U/RE:L

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

17.8%

JSON

There is a HIGH severity vulnerability affecting the CPython “zipfile”
module affecting “zipfile.Path”. Note that the more common API
“zipfile.ZipFile” class is unaffected.
When iterating over names of entries in a zip archive (for example, methods
of “zipfile.Path” like “namelist()”, “iterdir()”, etc)
the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchpython2.7< anyUNKNOWN
ubuntu20.04noarchpython2.7< anyUNKNOWN
ubuntu22.04noarchpython2.7< anyUNKNOWN
ubuntu14.04noarchpython2.7< anyUNKNOWN
ubuntu16.04noarchpython2.7< anyUNKNOWN
ubuntu22.04noarchpython3.10< anyUNKNOWN
ubuntu22.04noarchpython3.11< anyUNKNOWN
ubuntu24.04noarchpython3.12< anyUNKNOWN
ubuntu14.04noarchpython3.4< anyUNKNOWN
ubuntu14.04noarchpython3.5< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	python2.7	< any	UNKNOWN
ubuntu	20.04	noarch	python2.7	< any	UNKNOWN
ubuntu	22.04	noarch	python2.7	< any	UNKNOWN
ubuntu	14.04	noarch	python2.7	< any	UNKNOWN
ubuntu	16.04	noarch	python2.7	< any	UNKNOWN
ubuntu	22.04	noarch	python3.10	< any	UNKNOWN
ubuntu	22.04	noarch	python3.11	< any	UNKNOWN
ubuntu	24.04	noarch	python3.12	< any	UNKNOWN
ubuntu	14.04	noarch	python3.4	< any	UNKNOWN
ubuntu	14.04	noarch	python3.5	< any	UNKNOWN