nvd-json-data-feeds/CVE-2024/CVE-2024-04xx/CVE-2024-0450.json

{
  "id": "CVE-2024-0450",
  "sourceIdentifier": "cna@python.org",
  "published": "2024-03-19T16:15:09.180",
  "lastModified": "2025-04-11T22:15:28.817",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.\n\nThe zipfile module is vulnerable to \u201cquoted-overlap\u201d zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.\n\n"
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 un problema en el m\u00f3dulo `zipfile` de CPython que afecta a las versiones 3.12.2, 3.11.8, 3.10.13, 3.9.18 y 3.8.18 y anteriores. El m\u00f3dulo zipfile es vulnerable a bombas zip \"superpuestas entre comillas\" que explotan el formato zip para crear una bomba zip con una alta relaci\u00f3n de compresi\u00f3n. Las versiones fijas de CPython hacen que el m\u00f3dulo zipfile rechace archivos zip que se superponen con entradas en el archivo."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "cna@python.org",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "cna@python.org",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-405"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/03/20/5",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/30fe5d853b56138dbec62432d370a1f99409fc85",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/66363b9a7b9fe7c99eba3a185b74c5fdbf842eba",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/70497218351ba44bffc8b571201ecb5652d84675",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/a2c59992e9e8d35baba9695eb186ad6c6ff85c51",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/a956e510f6336d5ae111ba429a61c3ade30a7549",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/d05bac0b74153beb541b88b4fca33bf053990183",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/fa181fcf2156f703347b03a3b1966ce47be8ab3b",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/issues/109858",
      "source": "cna@python.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00024.html",
      "source": "cna@python.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00025.html",
      "source": "cna@python.org"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3IGRX54M7RNCQOXVQO5KQKTGWCOABIM/",
      "source": "cna@python.org"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5VHWS52HGD743C47UMCSAK2A773M2YE/",
      "source": "cna@python.org"
    },
    {
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/XELNUX2L3IOHBTFU7RQHCY6OUVEWZ2FG/",
      "source": "cna@python.org"
    },
    {
      "url": "https://www.bamsoftware.com/hacks/zipbomb/",
      "source": "cna@python.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/03/20/5",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/python/cpython/commit/30fe5d853b56138dbec62432d370a1f99409fc85",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/python/cpython/commit/66363b9a7b9fe7c99eba3a185b74c5fdbf842eba",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/python/cpython/commit/70497218351ba44bffc8b571201ecb5652d84675",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/python/cpython/commit/a2c59992e9e8d35baba9695eb186ad6c6ff85c51",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/python/cpython/commit/a956e510f6336d5ae111ba429a61c3ade30a7549",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/python/cpython/commit/d05bac0b74153beb541b88b4fca33bf053990183",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/python/cpython/commit/fa181fcf2156f703347b03a3b1966ce47be8ab3b",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/python/cpython/issues/109858",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00024.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00025.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3IGRX54M7RNCQOXVQO5KQKTGWCOABIM/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5VHWS52HGD743C47UMCSAK2A773M2YE/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/XELNUX2L3IOHBTFU7RQHCY6OUVEWZ2FG/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20250411-0005/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.bamsoftware.com/hacks/zipbomb/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}