CVE-2026-44722

Katalog CVE

CVSS 6.2 · Medium EPSS 0,12%

Kerentanan Use of Incorrect Operator. Skor CVSS 3.1 6.2 (Medium) menurut github.com.

Deskripsi (NVD)

pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfile_aes.py caused the AE-2 format to never be automatically selected during encryption, causing encrypted entries to be written in AE-1 format and exposing the plaintext CRC32 checksum in the ZIP header and, for unseekable zip archives, in the datadescripter section, allowing an attacker who possesses the archive to brute-force candidate plaintexts for small or low-entropy files by comparing CRC32 values. This issue is fixed in version 0.4.0.

Rincian

Terbit di NVD

17 Juli 2026

Terakhir diubah

17 Juli 2026

Status NVD

Deferred

CVSS 3.1

6.2 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-480: Use of Incorrect Operator

EPSS (30 hari)

0,12% peluang dieksploitasi; lebih tinggi dari 1,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/danifus/pyzipper/commit/93ce88e7dfd1635443197dab3fb8d477cff579ae
• https://github.com/danifus/pyzipper/releases/tag/v0.4.0
• https://github.com/danifus/pyzipper/security/advisories/GHSA-crqm-m339-7m2p