CVE-2024-8088CWE-835

Infinite loop when iterating over zip archive entry names from zipfile.Path

High · published August 22, 2024

CVSS v4.0
8.7
EPSS
1%
Percentile
69.7
In the wild
Unconfirmed
What it is

There is a HIGH severity vulnerability affecting the CPython "zipfile"

module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected.

When iterating over names of entries in a zip archive (for example, methods

of "zipfile.Path" like "namelist()", "iterdir()", etc)

the process can be put into an infinite loop with a maliciously crafted

zip archive. This defect applies when reading only metadata or extracting

the contents of the zip archive. Programs that are not handling

user-controlled zip archives are not affected.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:N/AU:N/R:U/RE:L
EPSS
0.01275 · 69.7th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2024-08-22T18:45Z
EPSS history
Timeline
  • 22 AUG 18:45Z
    Infinite loop when iterating over zip archive entry names from zipfile.Path
    cvelistv5