There is a severity vulnerability affecting the CPython "zipfile"
module.
When iterating over names of entries in a zip archive (for example, methods
of "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()", etc)
the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.
Platform | Package | Release Date | Advisory |
---|---|---|---|
Amazon Linux 2023 | python3.11 | 2024-12-05 20:34 | ALAS2023-2024-788 |
Amazon Linux 2023 | python3.9 | 2024-12-12 20:19 | ALAS2023-2024-790 |
Amazon Linux 2 - Python3.8 Extra | python38 | 2024-11-08 17:57 | ALAS2PYTHON3.8-2024-016 |
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |