CVE-2024-0450: Quoted zip-bomb protection for zipfile
An issue was found in the CPython zipfile module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
Other sources
Python CPython is vulnerable to a denial of service, caused by improper input validation by the zipfile module. By persuading a victim to open a specially crafted ZIP file, a remote attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0450?
CVE-2024-0450 is considered a moderate severity vulnerability due to its potential to create zip-bombs.
How do I fix CVE-2024-0450?
To fix CVE-2024-0450, upgrade to a patched version of the CPython zipfile module or update your Python installation to a secure version.
Which versions of Python are affected by CVE-2024-0450?
CVE-2024-0450 affects CPython versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18, along with earlier versions.
What are the potential impacts of CVE-2024-0450?
The vulnerability can allow attackers to create zip-bombs that may exhaust system resources when processed.
Is there a specific mitigation strategy for CVE-2024-0450?
The primary mitigation for CVE-2024-0450 is ensuring that you are running a version of Python that has addressed the vulnerability.