CVE-2024-0450 Quoted zip-bomb protection for zipfile
Attackers can cause denial of service in applications using the Python zipfile module by submitting crafted zip archives with high compression ratios.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-0450?
CVE-2024-0450 is a medium-severity denial of service vulnerability in CPython, published on 19 Mar 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.
The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
Weakness: CWE-405
Which versions are affected by CVE-2024-0450?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.8.19, 3.9.19, 3.10.14, 3.11.8, 3.12.2 |
python Bitnami | All versions | 3.8.19, 3.9.19, 3.10.14, 3.11.8, 3.12.2 |
python-min Bitnami | All versions | 3.8.19, 3.9.19, 3.10.14, 3.11.8, 3.12.2 |
Linux distribution packages (37)
python3.12 AlmaLinux:8 | All versions | 3.12.3-2.el8_10 |
python3.12-debug AlmaLinux:8 | All versions | 3.12.3-2.el8_10 |
python3.12-devel AlmaLinux:8 | All versions | 3.12.3-2.el8_10 |
python3.12-idle AlmaLinux:8 | All versions | 3.12.3-2.el8_10 |
python3.12-libs AlmaLinux:8 | All versions | 3.12.3-2.el8_10 |
python3.12-rpm-macros AlmaLinux:8 | All versions | 3.12.3-2.el8_10 |
python3.12-test AlmaLinux:8 | All versions | 3.12.3-2.el8_10 |
python3.12-tkinter AlmaLinux:8 | All versions | 3.12.3-2.el8_10 |
python3.12 Red Hat:enterprise_linux:8::appstream | All versions | 0:3.12.3-2.el8_10 |
python3.12-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:3.12.3-2.el8_10 |
python3.12-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:3.12.3-2.el8_10 |
python3.12-devel Red Hat:enterprise_linux:8::appstream | All versions | 0:3.12.3-2.el8_10 |
python3.12-libs Red Hat:enterprise_linux:8::appstream | All versions | 0:3.12.3-2.el8_10 |
python3.12-rpm-macros Red Hat:enterprise_linux:8::appstream | All versions | 0:3.12.3-2.el8_10 |
python3.12-tkinter Red Hat:enterprise_linux:8::appstream | All versions | 0:3.12.3-2.el8_10 |
python3.12 Red Hat:enterprise_linux:8::crb | All versions | 0:3.12.3-2.el8_10 |
python3.12-debug Red Hat:enterprise_linux:8::crb | All versions | 0:3.12.3-2.el8_10 |
python3.12-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:3.12.3-2.el8_10 |
python3.12-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:3.12.3-2.el8_10 |
python3.12-idle Red Hat:enterprise_linux:8::crb | All versions | 0:3.12.3-2.el8_10 |
python3.12-test Red Hat:enterprise_linux:8::crb | All versions | 0:3.12.3-2.el8_10 |
python3.12-tkinter Red Hat:enterprise_linux:8::crb | All versions | 0:3.12.3-2.el8_10 |
python3.12 Rocky Linux:8 | All versions | 0:3.12.3-2.el8_10 |
python3 SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 3.4.10-25.130.1 |
python3-base SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 3.4.10-25.130.1 |
python SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.7.18-33.35.1 |
python-base SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.7.18-33.35.1 |
python-doc SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.7.18-33.35.1 |
python3 SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.4.10-25.130.1 |
python3-base SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.4.10-25.130.1 |
python SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.7.18-33.35.1 |
python-base SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.7.18-33.35.1 |
python-doc SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.7.18-33.35.1 |
python3 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.4.10-25.130.1 |
python3-base SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.4.10-25.130.1 |
python3 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.4.10-25.130.1 |
python3-base SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.4.10-25.130.1 |
How do I fix CVE-2024-0450?
Upgrade libpython to a fixed version for your release line: 3.8.19, 3.9.19, 3.10.14 or 3.11.8.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-0450 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-0450 exists.
Sources
Also known as ALPINE-CVE-2024-0450, ALSA-2024:4243, AZL-36894, AZL-42573, BIT-libpython-2024-0450, BIT-python-2024-0450 and 19 more.