Today > vulnerabilities   -   You can now download lists of IOCs here!

CVE-2024-8088

Sept. 4, 2024, 11:15 p.m.

Tags

CWE-835
cna@python.org
2024-08-22
CVE-2024-8088

Product(s) Impacted

CPython

Description

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

Weaknesses

CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

CWE ID: 835

Date

Published: Aug. 22, 2024, 7:15 p.m.

Last Modified: Sept. 4, 2024, 11:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@python.org

References

https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://github.com/ cna@python.org
https://mail.python.org/ cna@python.org