« Volver al listado

CVE-2024-8088

Estado: AplazadaAlta (8.7)—

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected.

When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Python — CpythonAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8088",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8088",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-23T17:18:49.209334Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@python.org",
        "cvssData": {
          "Safety": "NEGLIGIBLE",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 8.7,
          "Automatable": "NO",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "LOW",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@python.org",
      "affectedData": [
        {
          "repo": "https://github.com/python/cpython",
          "vendor": "Python Software Foundation",
          "product": "CPython",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "3.8.20",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "3.9.0",
              "lessThan": "3.9.20",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "3.10.0",
              "lessThan": "3.10.15",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "3.11.0",
              "lessThan": "3.11.10",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "3.12.0",
              "lessThan": "3.12.6",
              "versionType": "python"
            },
            {
              "status": "affected",
              "version": "3.13.0a1",
              "lessThan": "3.13.0rc2",
              "versionType": "python"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:python_software_foundation:cpython:*:*:*:*:*:*:*:*"
          ],
          "vendor": "python_software_foundation",
          "product": "cpython",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "3.13.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-22T19:15:09.720",
  "references": [
    {
      "url": "https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894e",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6a",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788dea",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16db",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/issues/122905",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/issues/123270",
      "source": "cna@python.org"
    },
    {
      "url": "https://github.com/python/cpython/pull/122906",
      "source": "cna@python.org"
    },
    {
      "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/",
      "source": "cna@python.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/08/22/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/08/22/4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/08/23/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/08/23/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20241011-0010/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@python.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de gravedad ALTA que afecta al módulo \"zipfile\" de CPython. Al iterar sobre nombres de entradas en un archivo zip (por ejemplo, métodos de \"zipfile.ZipFile\" como \"namelist()\", \"iterdir()\", \"extractall()\", etc.), el proceso se puede poner en un infinito bucle con un archivo zip creado con fines malintencionados. Este defecto se aplica al leer solo metadatos o extraer el contenido del archivo zip. Los programas que no manejan archivos zip controlados por el usuario no se ven afectados."
    }
  ],
  "lastModified": "2026-06-17T08:21:50.750",
  "sourceIdentifier": "cna@python.org"
}