Malformed payload can lead to infinite loops in zipfile.Path #122905

Activity

1. jaraco

   self-assigned this

   on Aug 11, 2024
2. jaraco

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   type-securityA security issueA security issue

   on Aug 11, 2024
3. jaraco

   added 2 commits that reference this issue on Aug 11, 2024

   pythongh-122905: Sanitize names in zipfile.Path.

   ...

   1e15a83

   gh-122905: Sanitize names in zipfile.Path. (#122906)

   ...

   9cd0326
4. jaraco

   closed this as completedin #122906on Aug 11, 2024
5. miss-islington

   added 2 commits that reference this issue on Aug 11, 2024

   pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

   ...

   d6402c8

   pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

   ...

   ee9f405
6. jaraco

   added 4 commits that reference this issue on Aug 12, 2024

   pythongh-122905: Sanitize names in zipfile.Path. (python#122906)

   ...

   0d480f2

   [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906

   ...

   ed03fe9

   [3.13] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#122922)

   8c73489

   [3.12] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#122923)

   dcc5182
7. pablogsal

   added a commit that references this issue on Aug 19, 2024

   [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#122925)

   ...

   795f259
8. jaraco

   added 2 commits that reference this issue on Aug 19, 2024

   [3.10] [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pytho…

   ...

   d82745e

   [3.9] [3.11] pythongh-122905: Sanitize names in zipfile.Path. (python…

   ...

   8973dbf
9. blhsing

   added a commit that references this issue on Aug 22, 2024

   pythongh-122905: Sanitize names in zipfile.Path. (python#122906)

   ...

   c0d9e10
10. obfusk commented on Aug 22, 2024

    

    obfusk

    on Aug 22, 2024

    Last edited by obfusk

    Contributor

    More actions

    I provided some additional analysis here: https://www.openwall.com/lists/oss-security/2024/08/22/4
    Edit: and here: https://www.openwall.com/lists/oss-security/2024/08/23/1

    Also, the CVE and security announcement mistakenly say this affects methods of zipfile.ZipFile instead of zipfile.Path.
11. pablogsal

    added a commit that references this issue on Aug 22, 2024

    [3.10] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#123160)

    ...

    e0264a6
12. algitbot

    added 3 commits that reference this issue on Aug 23, 2024

    main/python3: fix CVE-2024-8088

    ...

    be30c12

    main/python3: fix CVE-2024-8088

    ...

    b223e20

    main/python3: fix CVE-2024-8088

    ...

    f0712e5
13. stratakis

    added 3 commits that reference this issue on Aug 23, 2024

    00436: [CVE-2024-8088] pythongh-122905: Sanitize names in zipfile.Path.

    7128553

    00436: [CVE-2024-8088] pythongh-122905: Sanitize names in zipfile.Path.

    ...

    0479a2a

    00436: [CVE-2024-8088] pythongh-122905: Sanitize names in zipfile.Path.

    ...

    431bbe9
14. bell-sw

    added a commit that references this issue on Aug 23, 2024

    core/python3: fix CVE-2024-8088

    ...

    4618dc5
15. algitbot

    added 2 commits that reference this issue on Aug 27, 2024

    main/python3: fix CVE-2024-8088

    ...

    99375d3

    main/python3: fix CVE-2024-8088

    ...

    e795bfc
16. hroncok

    added a commit that references this issue on Aug 28, 2024

    00436: [CVE-2024-8088] pythongh-122905: Sanitize names in zipfile.Path.

    ...

    59aca7f