zipfile DoS using invalid file size¶
Warning
This resource is maintained for historical reference and does not contain the latest vulnerability info for Python.
The canonical database for vulnerabilities affecting Python is available on GitHub in the Open Source Vulnerability (OSV) format. This vulnerability can be viewed online at the Open Source Vulnerability Database.
Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the functions:
ZipExtFile.read()ZipExtFile.readlines()ZipFile.extract()ZipFile.extractall()
Reading malformed zipfiles no longer hangs with 100% CPU consumption.
Python 2.7 is not affected.
Dates:
Disclosure date: 2013-12-27 (Python issue bpo-20078 reported)
Fixed In¶
Python 3.3.4 (2014-02-09) fixed by commit 5ce3f10 (branch 3.3) (2014-01-09)
Python 3.4.0 (2014-03-16) fixed by commit 5ce3f10 (branch 3.3) (2014-01-09)
Python issue¶
zipfile - ZipExtFile.read goes into 100% CPU infinite loop on maliciously binary edited zips.
Python issue: bpo-20078
Creation date: 2013-12-27
Reporter: Nandiya
CVE-2013-7338¶
Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.
CVE ID: CVE-2013-7338
Published: 2014-04-22
CVSS Score: 7.1
Timeline¶
Timeline using the disclosure date 2013-12-27 as reference:
2013-12-27: Python issue bpo-20078 reported by Nandiya
2014-01-09 (+13 days): commit 5ce3f10 (branch 3.3)
2014-02-09 (+44 days): Python 3.3.4 released
2014-03-16: Python 3.4.0 released
2014-04-22 (+116 days): CVE-2013-7338 published