CVE-2024-8088

Katalog CVE

CVSS 8.7 · High EPSS 1,3%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop'). Skor CVSS 4.0 8.7 (High) menurut python.org.

Deskripsi (NVD)

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

Rincian

Terbit di NVD

22 Agustus 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

8.7 (High), sumber python.org
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1
• https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6
• https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e
• https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814
• https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4
• https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64
• https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a
• https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7
• https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932
• https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea
• https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db
• https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798
• https://github.com/python/cpython/issues/122905
• https://github.com/python/cpython/issues/123270
• https://github.com/python/cpython/pull/122906
• https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/
• http://www.openwall.com/lists/oss-security/2024/08/22/1
• http://www.openwall.com/lists/oss-security/2024/08/22/4
• http://www.openwall.com/lists/oss-security/2024/08/23/1
• http://www.openwall.com/lists/oss-security/2024/08/23/2
• https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
• https://security.netapp.com/advisory/ntap-20241011-0010/