GHSA-q98g-hxg3-268c
Record from GitHub Advisory Database · Published August 22, 2024
There is a HIGH severity vulnerability affecting the CPython "zipfile" module. When iterating over names of entries in a zip archive (for example, methods of "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| python-3.10 | Chainguard | 3.10.14-r6 |
| python-3.12 | Chainguard | 3.12.5-r1 |
| python-3.12 | Wolfi | 3.12.5-r1 |
| python-3.11 | Chainguard | 3.11.9-r8 |
| python-3.10 | Wolfi | 3.10.14-r6 |
| python-3.9 | Chainguard | 3.9.20-r0 |
| python-3.11 | Wolfi | 3.11.9-r8 |
| python-3.8 | Chainguard | 3.8.19-r3 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | python-3.10 | 0 |
| chainguard | python-3.12 | 0 |
| wolfi | python-3.12 | 0 |
| chainguard | python-3.11 | 0 |
| wolfi | python-3.10 | 0 |
| chainguard | python-3.9 | 0 |
| wolfi | python-3.11 | 0 |
| chainguard | python-3.8 | 0 |
Timeline
- Aug 22, 2024 CVE Published
- May 1, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-q98g-hxg3-268c
vulnetix vdb fixes GHSA-q98g-hxg3-268cOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-q98g-hxg3-268c/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-8088 advisory
- https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU url
- https://security.netapp.com/advisory/ntap-20241011-0010 url
- http://www.openwall.com/lists/oss-security/2024/08/23/1 url
- http://www.openwall.com/lists/oss-security/2024/08/23/2 url
- http://www.openwall.com/lists/oss-security/2024/08/22/1 url
- http://www.openwall.com/lists/oss-security/2024/08/22/4 url
- https://github.com/python/cpython/issues/123270 discussion
- https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798 fix
- https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932 fix
- https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a fix
- https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e fix
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html advisory
- https://github.com/python/cpython/issues/122905 discussion
- https://github.com/python/cpython/pull/122906 fix
- https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db fix
- https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea fix
- https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7 fix
- https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64 fix
- https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4 fix
…and 3 more