There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected.
When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-python-unversioned-commandalma-upgrade-python3alma-upgrade-python3-debugalma-upgrade-python3-develalma-upgrade-python3-idlealma-upgrade-python3-libsalma-upgrade-python3-testalma-upgrade-python3-tkinteralma-upgrade-python3.11alma-upgrade-python3.11-debugalma-upgrade-python3.11-develalma-upgrade-python3.11-idlealma-upgrade-python3.11-libsalma-upgrade-python3.11-rpm-macrosalma-upgrade-python3.11-testalma-upgrade-python3.11-tkinteralma-upgrade-python3.12alma-upgrade-python3.12-debugalma-upgrade-python3.12-develalma-upgrade-python3.12-idlealma-upgrade-python3.12-libsalma-upgrade-python3.12-rpm-macrosalma-upgrade-python3.12-testalma-upgrade-python3.12-tkinteralma-upgrade-python39alma-upgrade-python39-attrsalma-upgrade-python39-cffialma-upgrade-python39-chardetalma-upgrade-python39-cryptographyalma-upgrade-python39-cythonalma-upgrade-python39-debugalma-upgrade-python39-develalma-upgrade-python39-idlealma-upgrade-python39-idnaalma-upgrade-python39-iniconfigalma-upgrade-python39-libsalma-upgrade-python39-lxmlalma-upgrade-python39-mod_wsgialma-upgrade-python39-more-itertoolsalma-upgrade-python39-numpyalma-upgrade-python39-numpy-docalma-upgrade-python39-numpy-f2pyalma-upgrade-python39-packagingalma-upgrade-python39-pipalma-upgrade-python39-pip-wheelalma-upgrade-python39-pluggyalma-upgrade-python39-plyalma-upgrade-python39-psutilalma-upgrade-python39-psycopg2alma-upgrade-python39-psycopg2-docalma-upgrade-python39-psycopg2-testsalma-upgrade-python39-pyalma-upgrade-python39-pybind11alma-upgrade-python39-pybind11-develalma-upgrade-python39-pycparseralma-upgrade-python39-pymysqlalma-upgrade-python39-pyparsingalma-upgrade-python39-pysocksalma-upgrade-python39-pytestalma-upgrade-python39-pyyamlalma-upgrade-python39-requestsalma-upgrade-python39-rpm-macrosalma-upgrade-python39-scipyalma-upgrade-python39-setuptoolsalma-upgrade-python39-setuptools-wheelalma-upgrade-python39-sixalma-upgrade-python39-testalma-upgrade-python39-tkinteralma-upgrade-python39-tomlalma-upgrade-python39-urllib3alma-upgrade-python39-wcwidthalma-upgrade-python39-wheelalma-upgrade-python39-wheel-wheel | Aug 30, 2024 | Aug 22, 2024 | |
| Alpine Linux | alpine-linux-upgrade-python3 | Oct 1, 2024 | Aug 22, 2024 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-python38amazon-linux-ami-2-upgrade-python38-debugamazon-linux-ami-2-upgrade-python38-debuginfoamazon-linux-ami-2-upgrade-python38-develamazon-linux-ami-2-upgrade-python38-libsamazon-linux-ami-2-upgrade-python38-testamazon-linux-ami-2-upgrade-python38-tkinteramazon-linux-ami-2-upgrade-python38-tools | Nov 14, 2024 | Aug 22, 2024 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-python3amazon-linux-2023-upgrade-python3-11amazon-linux-2023-upgrade-python3-11-debugamazon-linux-2023-upgrade-python3-11-debuginfoamazon-linux-2023-upgrade-python3-11-debugsourceamazon-linux-2023-upgrade-python3-11-develamazon-linux-2023-upgrade-python3-11-idleamazon-linux-2023-upgrade-python3-11-libsamazon-linux-2023-upgrade-python3-11-testamazon-linux-2023-upgrade-python3-11-tkinteramazon-linux-2023-upgrade-python3-9-debuginfoamazon-linux-2023-upgrade-python3-9-debugsourceamazon-linux-2023-upgrade-python3-debugamazon-linux-2023-upgrade-python3-develamazon-linux-2023-upgrade-python3-idleamazon-linux-2023-upgrade-python3-libsamazon-linux-2023-upgrade-python3-testamazon-linux-2023-upgrade-python3-tkinteramazon-linux-2023-upgrade-python-unversioned-command | Feb 17, 2025 | Aug 22, 2024 | |
| Debian | debian-upgrade-python3-11debian-upgrade-python3-9 | Aug 28, 2024 | Aug 22, 2024 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-lang-pypygentoo-linux-upgrade-dev-lang-python | Jun 13, 2025 | Aug 22, 2024 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-python3huawei-euleros-2_0_sp11-upgrade-python3-unversioned-command | Dec 12, 2024 | Aug 22, 2024 | |
| Huawei Euleros 2_0_sp12 | huawei-euleros-2_0_sp12-upgrade-python3huawei-euleros-2_0_sp12-upgrade-python3-fgohuawei-euleros-2_0_sp12-upgrade-python3-unversioned-command | Dec 12, 2024 | Aug 22, 2024 | |
| Ibm Aix | ibm-aix-python_advisory13 | Nov 6, 2024 | Aug 22, 2024 | |
| Oracle_linux | — | oracle-linux-upgrade-python3oracle-linux-upgrade-python3-11oracle-linux-upgrade-python3-11-debugoracle-linux-upgrade-python3-11-develoracle-linux-upgrade-python3-11-idleoracle-linux-upgrade-python3-11-libsoracle-linux-upgrade-python3-11-rpm-macrosoracle-linux-upgrade-python3-11-testoracle-linux-upgrade-python3-11-tkinteroracle-linux-upgrade-python3-12oracle-linux-upgrade-python3-12-debugoracle-linux-upgrade-python3-12-develoracle-linux-upgrade-python3-12-idleoracle-linux-upgrade-python3-12-libsoracle-linux-upgrade-python3-12-rpm-macrosoracle-linux-upgrade-python3-12-testoracle-linux-upgrade-python3-12-tkinteroracle-linux-upgrade-python39oracle-linux-upgrade-python39-cffioracle-linux-upgrade-python39-chardetoracle-linux-upgrade-python39-cryptographyoracle-linux-upgrade-python39-debugoracle-linux-upgrade-python39-develoracle-linux-upgrade-python39-idleoracle-linux-upgrade-python39-idnaoracle-linux-upgrade-python39-libsoracle-linux-upgrade-python39-lxmloracle-linux-upgrade-python39-mod-wsgioracle-linux-upgrade-python39-numpyoracle-linux-upgrade-python39-numpy-docoracle-linux-upgrade-python39-numpy-f2pyoracle-linux-upgrade-python39-piporacle-linux-upgrade-python39-pip-wheeloracle-linux-upgrade-python39-plyoracle-linux-upgrade-python39-psutiloracle-linux-upgrade-python39-psycopg2oracle-linux-upgrade-python39-psycopg2-docoracle-linux-upgrade-python39-psycopg2-testsoracle-linux-upgrade-python39-pycparseroracle-linux-upgrade-python39-pymysqloracle-linux-upgrade-python39-pysocksoracle-linux-upgrade-python39-pyyamloracle-linux-upgrade-python39-requestsoracle-linux-upgrade-python39-rpm-macrosoracle-linux-upgrade-python39-scipyoracle-linux-upgrade-python39-setuptoolsoracle-linux-upgrade-python39-setuptools-wheeloracle-linux-upgrade-python39-sixoracle-linux-upgrade-python39-testoracle-linux-upgrade-python39-tkinteroracle-linux-upgrade-python39-tomloracle-linux-upgrade-python39-urllib3oracle-linux-upgrade-python39-wheeloracle-linux-upgrade-python39-wheel-wheeloracle-linux-upgrade-python3-debugoracle-linux-upgrade-python3-develoracle-linux-upgrade-python3-idleoracle-linux-upgrade-python3-libsoracle-linux-upgrade-python3-testoracle-linux-upgrade-python3-tkinteroracle-linux-upgrade-python-unversioned-command | Oct 16, 2024 | Aug 22, 2024 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-cython-debugsourceredhat-upgrade-numpy-debugsourceredhat-upgrade-python-cffi-debugsourceredhat-upgrade-python-cryptography-debugsourceredhat-upgrade-python-lxml-debugsourceredhat-upgrade-python-psutil-debugsourceredhat-upgrade-python-psycopg2-debugsourceredhat-upgrade-python-unversioned-commandredhat-upgrade-python3redhat-upgrade-python3-11redhat-upgrade-python3-11-debugredhat-upgrade-python3-11-debuginforedhat-upgrade-python3-11-debugsourceredhat-upgrade-python3-11-develredhat-upgrade-python3-11-idleredhat-upgrade-python3-11-libsredhat-upgrade-python3-11-rpm-macrosredhat-upgrade-python3-11-testredhat-upgrade-python3-11-tkinterredhat-upgrade-python3-12redhat-upgrade-python3-12-debugredhat-upgrade-python3-12-debuginforedhat-upgrade-python3-12-debugsourceredhat-upgrade-python3-12-develredhat-upgrade-python3-12-idleredhat-upgrade-python3-12-libsredhat-upgrade-python3-12-rpm-macrosredhat-upgrade-python3-12-testredhat-upgrade-python3-12-tkinterredhat-upgrade-python3-9-debuginforedhat-upgrade-python3-9-debugsourceredhat-upgrade-python3-debugredhat-upgrade-python3-develredhat-upgrade-python3-idleredhat-upgrade-python3-libsredhat-upgrade-python3-testredhat-upgrade-python3-tkinterredhat-upgrade-python39redhat-upgrade-python39-attrsredhat-upgrade-python39-cffiredhat-upgrade-python39-cffi-debuginforedhat-upgrade-python39-chardetredhat-upgrade-python39-cryptographyredhat-upgrade-python39-cryptography-debuginforedhat-upgrade-python39-cythonredhat-upgrade-python39-cython-debuginforedhat-upgrade-python39-debugredhat-upgrade-python39-debuginforedhat-upgrade-python39-debugsourceredhat-upgrade-python39-develredhat-upgrade-python39-idleredhat-upgrade-python39-idnaredhat-upgrade-python39-iniconfigredhat-upgrade-python39-libsredhat-upgrade-python39-lxmlredhat-upgrade-python39-lxml-debuginforedhat-upgrade-python39-mod_wsgiredhat-upgrade-python39-more-itertoolsredhat-upgrade-python39-numpyredhat-upgrade-python39-numpy-debuginforedhat-upgrade-python39-numpy-docredhat-upgrade-python39-numpy-f2pyredhat-upgrade-python39-packagingredhat-upgrade-python39-pipredhat-upgrade-python39-pip-wheelredhat-upgrade-python39-pluggyredhat-upgrade-python39-plyredhat-upgrade-python39-psutilredhat-upgrade-python39-psutil-debuginforedhat-upgrade-python39-psycopg2redhat-upgrade-python39-psycopg2-debuginforedhat-upgrade-python39-psycopg2-docredhat-upgrade-python39-psycopg2-testsredhat-upgrade-python39-pyredhat-upgrade-python39-pybind11redhat-upgrade-python39-pybind11-develredhat-upgrade-python39-pycparserredhat-upgrade-python39-pymysqlredhat-upgrade-python39-pyparsingredhat-upgrade-python39-pysocksredhat-upgrade-python39-pytestredhat-upgrade-python39-pyyamlredhat-upgrade-python39-pyyaml-debuginforedhat-upgrade-python39-requestsredhat-upgrade-python39-rpm-macrosredhat-upgrade-python39-scipyredhat-upgrade-python39-scipy-debuginforedhat-upgrade-python39-setuptoolsredhat-upgrade-python39-setuptools-wheelredhat-upgrade-python39-sixredhat-upgrade-python39-testredhat-upgrade-python39-tkinterredhat-upgrade-python39-tomlredhat-upgrade-python39-urllib3redhat-upgrade-python39-wcwidthredhat-upgrade-python39-wheelredhat-upgrade-python39-wheel-wheelredhat-upgrade-pyyaml-debugsourceredhat-upgrade-scipy-debugsource | Sep 13, 2024 | Aug 22, 2024 | |
| Rocky_linux | rocky-upgrade-cython-debugsourcerocky-upgrade-numpy-debugsourcerocky-upgrade-python-cffi-debugsourcerocky-upgrade-python-cryptography-debugsourcerocky-upgrade-python-lxml-debugsourcerocky-upgrade-python-psutil-debugsourcerocky-upgrade-python-psycopg2-debugsourcerocky-upgrade-python3.11rocky-upgrade-python3.11-debugrocky-upgrade-python3.11-debuginforocky-upgrade-python3.11-debugsourcerocky-upgrade-python3.11-develrocky-upgrade-python3.11-idlerocky-upgrade-python3.11-libsrocky-upgrade-python3.11-testrocky-upgrade-python3.11-tkinterrocky-upgrade-python3.12rocky-upgrade-python3.12-debugrocky-upgrade-python3.12-debuginforocky-upgrade-python3.12-debugsourcerocky-upgrade-python3.12-develrocky-upgrade-python3.12-idlerocky-upgrade-python3.12-libsrocky-upgrade-python3.12-testrocky-upgrade-python3.12-tkinterrocky-upgrade-python39rocky-upgrade-python39-cffirocky-upgrade-python39-cffi-debuginforocky-upgrade-python39-cryptographyrocky-upgrade-python39-cryptography-debuginforocky-upgrade-python39-cythonrocky-upgrade-python39-cython-debuginforocky-upgrade-python39-debugrocky-upgrade-python39-debuginforocky-upgrade-python39-debugsourcerocky-upgrade-python39-develrocky-upgrade-python39-idlerocky-upgrade-python39-libsrocky-upgrade-python39-lxmlrocky-upgrade-python39-lxml-debuginforocky-upgrade-python39-mod_wsgirocky-upgrade-python39-numpyrocky-upgrade-python39-numpy-debuginforocky-upgrade-python39-numpy-f2pyrocky-upgrade-python39-psutilrocky-upgrade-python39-psutil-debuginforocky-upgrade-python39-psycopg2rocky-upgrade-python39-psycopg2-debuginforocky-upgrade-python39-psycopg2-docrocky-upgrade-python39-psycopg2-testsrocky-upgrade-python39-pybind11rocky-upgrade-python39-pybind11-develrocky-upgrade-python39-pyyamlrocky-upgrade-python39-pyyaml-debuginforocky-upgrade-python39-scipyrocky-upgrade-python39-scipy-debuginforocky-upgrade-python39-testrocky-upgrade-python39-tkinterrocky-upgrade-pyyaml-debugsourcerocky-upgrade-scipy-debugsource | Oct 2, 2024 | Aug 22, 2024 | |
| Suse | — | suse-upgrade-libpython3_10-1_0suse-upgrade-libpython3_10-1_0-32bitsuse-upgrade-libpython3_11-1_0suse-upgrade-libpython3_11-1_0-32bitsuse-upgrade-libpython3_12-1_0suse-upgrade-libpython3_12-1_0-32bitsuse-upgrade-libpython3_13-1_0suse-upgrade-libpython3_13-1_0-x86-64-v3suse-upgrade-libpython3_9-1_0suse-upgrade-libpython3_9-1_0-32bitsuse-upgrade-python310suse-upgrade-python310-32bitsuse-upgrade-python310-basesuse-upgrade-python310-base-32bitsuse-upgrade-python310-cursessuse-upgrade-python310-dbmsuse-upgrade-python310-develsuse-upgrade-python310-docsuse-upgrade-python310-doc-devhelpsuse-upgrade-python310-idlesuse-upgrade-python310-testsuitesuse-upgrade-python310-tksuse-upgrade-python310-toolssuse-upgrade-python311suse-upgrade-python311-32bitsuse-upgrade-python311-basesuse-upgrade-python311-base-32bitsuse-upgrade-python311-cursessuse-upgrade-python311-dbmsuse-upgrade-python311-develsuse-upgrade-python311-docsuse-upgrade-python311-doc-devhelpsuse-upgrade-python311-idlesuse-upgrade-python311-testsuitesuse-upgrade-python311-tksuse-upgrade-python311-toolssuse-upgrade-python312suse-upgrade-python312-32bitsuse-upgrade-python312-basesuse-upgrade-python312-base-32bitsuse-upgrade-python312-cursessuse-upgrade-python312-dbmsuse-upgrade-python312-develsuse-upgrade-python312-docsuse-upgrade-python312-doc-devhelpsuse-upgrade-python312-idlesuse-upgrade-python312-testsuitesuse-upgrade-python312-tksuse-upgrade-python312-toolssuse-upgrade-python313suse-upgrade-python313-basesuse-upgrade-python313-base-x86-64-v3suse-upgrade-python313-cursessuse-upgrade-python313-dbmsuse-upgrade-python313-develsuse-upgrade-python313-docsuse-upgrade-python313-doc-devhelpsuse-upgrade-python313-idlesuse-upgrade-python313-tksuse-upgrade-python313-toolssuse-upgrade-python313-x86-64-v3suse-upgrade-python39suse-upgrade-python39-32bitsuse-upgrade-python39-basesuse-upgrade-python39-base-32bitsuse-upgrade-python39-cursessuse-upgrade-python39-dbmsuse-upgrade-python39-develsuse-upgrade-python39-docsuse-upgrade-python39-doc-devhelpsuse-upgrade-python39-idlesuse-upgrade-python39-testsuitesuse-upgrade-python39-tksuse-upgrade-python39-tools | Dec 31, 2024 | Aug 22, 2024 |
| Ubuntu | ubuntu-upgrade-python3-10ubuntu-upgrade-python3-10-minimalubuntu-upgrade-python3-12ubuntu-upgrade-python3-12-minimalubuntu-upgrade-python3-8ubuntu-upgrade-python3-8-minimal | Sep 17, 2024 | Aug 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub