GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Malformed payload can lead to infinite loops in zipfile.Path · Issue #122905 · python/cpython

Malformed payload can lead to infinite loops in zipfile.Path #122905

New issue
Copy link
New issue
Copy link
Closed
#122906
Closed
Malformed payload can lead to infinite loops in zipfile.Path#122905
#122906
Copy link
Assignees
jaraco
Labels
type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-securityA security issueA security issue

Description

@jaraco
jaraco
opened on Aug 11, 2024
Issue body actions

As reported in jaraco/zipp#119, malformed paths in a zipfile can lead to undesirable behaviors (infinite loops) when traversed using zipfile.Path.

This issue tracks porting that fix to CPython.

Linked PRs

  • gh-122905: Sanitize names in zipfile.Path. #122906
  • [3.13] gh-122905: Sanitize names in zipfile.Path. (GH-122906) #122922
  • [3.12] gh-122905: Sanitize names in zipfile.Path. (GH-122906) #122923
  • [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906) #122925
  • [3.10] gh-122905: Sanitize names in zipfile.Path. (GH-122906) #123160
  • [3.9] gh-122905: Sanitize names in zipfile.Path. (GH-122906) #123161
  • [3.8] gh-122905: Sanitize names in zipfile.Path. (GH-122906) #123162

Activity

  1. jaraco
    self-assigned this
    on Aug 11, 2024
  2. jaraco
    added
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    type-securityA security issueA security issue
    on Aug 11, 2024
  3. jaraco
    added 2 commits that reference this issue on Aug 11, 2024

    pythongh-122905: Sanitize names in zipfile.Path.

    1e15a83

    gh-122905: Sanitize names in zipfile.Path. (#122906)

    9cd0326
  4. jaraco
    closed this as completedin #122906on Aug 11, 2024
  5. miss-islington
    added 2 commits that reference this issue on Aug 11, 2024

    pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

    d6402c8

    pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906)

    ee9f405
  6. jaraco
    added 4 commits that reference this issue on Aug 12, 2024

    pythongh-122905: Sanitize names in zipfile.Path. (python#122906)

    0d480f2

    [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pythonGH-122906

    ed03fe9

    [3.13] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#122922)

    8c73489

    [3.12] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#122923)

    dcc5182
  7. pablogsal
    added a commit that references this issue on Aug 19, 2024

    [3.11] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#122925)

    795f259
  8. jaraco
    added 2 commits that reference this issue on Aug 19, 2024

    [3.10] [3.11] pythongh-122905: Sanitize names in zipfile.Path. (pytho…

    d82745e

    [3.9] [3.11] pythongh-122905: Sanitize names in zipfile.Path. (python…

    8973dbf
  9. blhsing
    added a commit that references this issue on Aug 22, 2024

    pythongh-122905: Sanitize names in zipfile.Path. (python#122906)

    c0d9e10

  10. obfusk commented on Aug 22, 2024

    @obfusk
    obfusk
    on Aug 22, 2024
    Contributor
    More actions

    I provided some additional analysis here: https://www.openwall.com/lists/oss-security/2024/08/22/4
    Edit: and here: https://www.openwall.com/lists/oss-security/2024/08/23/1

    Also, the CVE and security announcement mistakenly say this affects methods of zipfile.ZipFile instead of zipfile.Path.

  11. pablogsal
    added a commit that references this issue on Aug 22, 2024

    [3.10] gh-122905: Sanitize names in zipfile.Path. (GH-122906) (#123160)

    e0264a6
  12. algitbot
    added 3 commits that reference this issue on Aug 23, 2024

    main/python3: fix CVE-2024-8088

    be30c12

    main/python3: fix CVE-2024-8088

    b223e20

    main/python3: fix CVE-2024-8088

    f0712e5
  13. stratakis
    added 3 commits that reference this issue on Aug 23, 2024

    00436: [CVE-2024-8088] pythongh-122905: Sanitize names in zipfile.Path.

    7128553

    00436: [CVE-2024-8088] pythongh-122905: Sanitize names in zipfile.Path.

    0479a2a

    00436: [CVE-2024-8088] pythongh-122905: Sanitize names in zipfile.Path.

    431bbe9
  14. bell-sw
    added a commit that references this issue on Aug 23, 2024

    core/python3: fix CVE-2024-8088

    4618dc5
  15. algitbot
    added 2 commits that reference this issue on Aug 27, 2024

    main/python3: fix CVE-2024-8088

    99375d3

    main/python3: fix CVE-2024-8088

    e795bfc
  16. hroncok
    added a commit that references this issue on Aug 28, 2024

    00436: [CVE-2024-8088] pythongh-122905: Sanitize names in zipfile.Path.

    59aca7f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

  • @jaraco
    jaraco

Labels

type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-securityA security issueA security issue

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions
    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.