CVE-2024-8088

Description

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

How to fix CVE-2024-8088

To remediate CVE-2024-8088, upgrade the affected package to a fixed version below.

• —upgrade to 3.10.14-r2 or later
• —upgrade to 3.8.20 or later
• —upgrade to 3.8.20 or later
• —upgrade to 3.8.20 or later
• —no fix listed
• —upgrade to 3.11.2-6+deb12u3 or later
• —upgrade to 3.13.0~rc2-1 or later
• —upgrade to 3.9.2-1+deb11u2 or later

Is CVE-2024-8088 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (8)

• from 0, < 3.10.14-r2
• from 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.15, >= 3.11.0, < 3.11.10, >= 3.12.0, < 3.12.6
• from 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.15, >= 3.11.0, < 3.11.10, >= 3.12.0, < 3.12.6
• from 0, < 3.8.20, >= 3.9.0, < 3.9.20, >= 3.10.0, < 3.10.15, >= 3.11.0, < 3.11.10, >= 3.12.0, < 3.12.6
• from 0
• from 0, < 3.11.2-6+deb12u3
• from 0, < 3.13.0~rc2-1
• from 0, < 3.9.2-1+deb11u2

CVSS scores

References (25)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2024-8088
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2024-8088
• WEBgithub.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1
• WEBgithub.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6