Quoted zip-bomb protection for zipfile
Priority MEDIUM 61CWE-405Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 17 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix Partial CPython (Python Software Foundation): 3.8.19, 3.9.19, 3.10.14 +3Red Hat: 11 advisoriesRed Hat: 17 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Python Software Foundation | CPython | before 3.8.19; 3.9.0 to before 3.9.19; 3.10.0 to before 3.10.14; 3.11.0 to before 3.11.8; 3.12.0 to before 3.12.2; 3.13.0a1 to before 3.13.0a3 | 3.8.19, 3.9.19, 3.10.14, 3.11.8, 3.12.2, 3.13.0a3 | Patch available | CNA |
- CPython VendorPython Software Foundation Affected before 3.8.19; 3.9.0 to before 3.9.19; 3.10.0 to before 3.10.14; 3.11.0 to before 3.11.8; 3.12.0 to before 3.12.2; 3.13.0a1 to before 3.13.0a3 Fixed in 3.8.19, 3.9.19, 3.10.14, 3.11.8, 3.12.2, 3.13.0a3 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:* | — | — | python-pillow |
- cpe:2.3:a:python:cpython:*:*:*:*:*:*:*:* Versions — — ·python-pillow
Remediation
- Fix · CNA CPython (Python Software Foundation) Fixed in 3.8.19, 3.9.19, 3.10.14, 3.11.8, 3.12.2, 3.13.0a3
Red Hat 11 advisories
- RHSA-2024:9190 Released 2024-11-12 · Red Hat rating Moderatepython3.12 security update
- Red Hat CodeReady Linux Builder (v. 9) python3.12-3.12.5-2.el9, python3.12-debug-3.12.5-2.el9, python3.12-idle-3.12.5-2.el9 +2
- Red Hat Enterprise Linux AppStream (v. 9) python3.12-3.12.5-2.el9, python3.12-devel-3.12.5-2.el9, python3.12-libs-3.12.5-2.el9 +1
- RHSA-2024:9192 Released 2024-11-12 · Red Hat rating Moderatepython3.11 security update
- Red Hat CodeReady Linux Builder (v. 9) python3.11-3.11.9-7.el9, python3.11-debug-3.11.9-7.el9, python3.11-idle-3.11.9-7.el9 +2
- Red Hat Enterprise Linux AppStream (v. 9) python3.11-3.11.9-7.el9, python3.11-devel-3.11.9-7.el9, python3.11-libs-3.11.9-7.el9 +1
- RHSA-2024:4871 Released 2024-07-25 · Red Hat rating ModerateRed Hat Service Interconnect security update
- Red Hat Service Interconnect 1 service-interconnect/skupper-flow-collector-rhel9, service-interconnect/skupper-router-rhel9, service-interconnect/skupper-service-controller-rhel9
Show 8 more Red Hat advisories
- RHSA-2024:4865 Released 2024-07-25 · Red Hat rating ModerateRed Hat Service Interconnect security update
- 9Base-Service-Interconnect-1.4 service-interconnect/skupper-flow-collector-rhel9, service-interconnect/skupper-router-rhel9, service-interconnect/skupper-service-controller-rhel9
- RHSA-2024:4406 Released 2024-07-09 · Red Hat rating Importantpython3 security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) platform-python-3.6.8-47.el8_6.6, platform-python-debug-3.6.8-47.el8_6.6, platform-python-devel-3.6.8-47.el8_6.6 +3
- Red Hat Enterprise Linux AppStream E4S (v.8.6) platform-python-3.6.8-47.el8_6.6, platform-python-debug-3.6.8-47.el8_6.6, platform-python-devel-3.6.8-47.el8_6.6 +3
- Red Hat Enterprise Linux AppStream TUS (v.8.6) platform-python-3.6.8-47.el8_6.6, platform-python-debug-3.6.8-47.el8_6.6, platform-python-devel-3.6.8-47.el8_6.6 +3
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) platform-python-3.6.8-47.el8_6.6, python3-3.6.8-47.el8_6.6, python3-libs-3.6.8-47.el8_6.6 +1
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) platform-python-3.6.8-47.el8_6.6, python3-3.6.8-47.el8_6.6, python3-libs-3.6.8-47.el8_6.6 +1
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) platform-python-3.6.8-47.el8_6.6, python3-3.6.8-47.el8_6.6, python3-libs-3.6.8-47.el8_6.6 +1
- RHSA-2024:4243 Released 2024-07-02 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream (v. 8) python3.12-3.12.3-2.el8_10, python3.12-devel-3.12.3-2.el8_10, python3.12-libs-3.12.3-2.el8_10 +2
- Red Hat Enterprise Linux CRB (v. 8) python3.12-3.12.3-2.el8_10, python3.12-debug-3.12.3-2.el8_10, python3.12-idle-3.12.3-2.el8_10 +2
- RHSA-2024:4078 Released 2024-06-25 · Red Hat rating Importantpython3.9 security update
- Red Hat Enterprise Linux AppStream (v. 9) python-unversioned-command-3.9.18-3.el9_4.1, python3-devel-3.9.18-3.el9_4.1, python3-tkinter-3.9.18-3.el9_4.1
- Red Hat Enterprise Linux BaseOS (v. 9) python3-3.9.18-3.el9_4.1, python3-libs-3.9.18-3.el9_4.1, python3.9-3.9.18-3.el9_4.1
- Red Hat Enterprise Linux CRB (v. 9) python3-3.9.18-3.el9_4.1, python3-debug-3.9.18-3.el9_4.1, python3-idle-3.9.18-3.el9_4.1 +2
- RHSA-2024:4058 Released 2024-06-24 · Red Hat rating Importantpython3.11 security update
- Red Hat Enterprise Linux AppStream (v. 8) python3.11-3.11.9-1.el8_10, python3.11-devel-3.11.9-1.el8_10, python3.11-libs-3.11.9-1.el8_10 +2
- Red Hat Enterprise Linux CRB (v. 8) python3.11-3.11.9-1.el8_10, python3.11-debug-3.11.9-1.el8_10, python3.11-idle-3.11.9-1.el8_10 +2
- RHSA-2024:3466 Released 2024-05-29 · Red Hat rating Importantpython39:3.9 and python39-devel:3.9 security update
- Red Hat Enterprise Linux AppStream (v. 8) PyYAML-5.4.1-1.module+el8.9.0+19644+d68f775d.src::python39:3.9, mod_wsgi-4.7.1-7.module+el8.9.0+19644+d68f775d.src::python39:3.9, numpy-1.19.4-3.module+el8.9.0+19644+d68f775d.src::python39:3.9 +47
- Red Hat Enterprise Linux CRB (v. 8) Cython-0.29.21-5.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pybind11-2.7.1-1.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9, pytest-6.0.2-2.module+el8.9.0+19644+d68f775d.src::python39-devel:3.9 +33
- RHSA-2024:3391 Released 2024-05-28 · Red Hat rating Importantpython3 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) platform-python-3.6.8-51.el8_8.6, platform-python-debug-3.6.8-51.el8_8.6, platform-python-devel-3.6.8-51.el8_8.6 +3
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) platform-python-3.6.8-51.el8_8.6, python3-3.6.8-51.el8_8.6, python3-libs-3.6.8-51.el8_8.6 +1
- RHSA-2024:3347 Released 2024-05-23 · Red Hat rating Importantpython3 security update
- Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-62.el8_10, platform-python-debug-3.6.8-62.el8_10, platform-python-devel-3.6.8-62.el8_10 +3
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-62.el8_10, python3-3.6.8-62.el8_10, python3-libs-3.6.8-62.el8_10 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| 9Base-Service-Interconnect-1.4 | Fixed | RHSA-2024:4865 |
| Red Hat CodeReady Linux Builder (v. 9) | Fixed | RHSA-2024:9190, RHSA-2024:9192 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:3347, RHSA-2024:3466, RHSA-2024:4058, RHSA-2024:4243 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:4078, RHSA-2024:9190, RHSA-2024:9192 |
| Red Hat Enterprise Linux AppStream AUS (v.8.6) | Fixed | RHSA-2024:4406 |
| Red Hat Enterprise Linux AppStream E4S (v.8.6) | Fixed | RHSA-2024:4406 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:3391 |
| Red Hat Enterprise Linux AppStream TUS (v.8.6) | Fixed | RHSA-2024:4406 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2024:3347 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2024:4078 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2024:4406 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2024:4406 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2024:3391 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2024:4406 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2024:3466, RHSA-2024:4058, RHSA-2024:4243 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2024:4078 |
| Red Hat Service Interconnect 1 | Fixed | RHSA-2024:4871 |
Not affected: 7 products
- 9Base-Service-Interconnect-1.4
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux AppStream E4S (v.8.6)
- Red Hat Enterprise Linux BaseOS E4S (v.8.6)
- Red Hat Service Interconnect 1
Timeline
- 2026-10-02 Threatist record created from CVE-2024-0450
- 2026-10-03 Alias added: GHSA-jm46-725r-hh9v
- 2026-11-05 Affected versions changed · Red Hat
References
Patch 7
- https://github.com/python/cpython/commit/66363b9a7b9fe7c99eba3a185b74c5fdbf842eba
- https://github.com/python/cpython/commit/fa181fcf2156f703347b03a3b1966ce47be8ab3b
- https://github.com/python/cpython/commit/a956e510f6336d5ae111ba429a61c3ade30a7549
- https://github.com/python/cpython/commit/30fe5d853b56138dbec62432d370a1f99409fc85
- https://github.com/python/cpython/commit/a2c59992e9e8d35baba9695eb186ad6c6ff85c51
- https://github.com/python/cpython/commit/d05bac0b74153beb541b88b4fca33bf053990183
- https://github.com/python/cpython/commit/70497218351ba44bffc8b571201ecb5652d84675
Advisory 1
Other 7
- https://github.com/python/cpython/issues/109858
- https://www.bamsoftware.com/hacks/zipbomb/
- https://lists.debian.org/debian-lts-announce/2024/03/msg00024.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00025.html
- http://www.openwall.com/lists/oss-security/2024/03/20/5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/T3IGRX54M7RNCQOXVQO5KQKTGWCOABIM/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/U5VHWS52HGD743C47UMCSAK2A773M2YE/
More Python Software Foundation vulnerabilities
- TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
- TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
- TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
- TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
- TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
- TI-2025-07587 ZIP64 End of Central Directory (EOCD) Locator record offset not checked CVSS 3.1MEDIUM 4.3
Sources
- CVE-2024-0450 · CVE Program
- CVE-2024-0450 · NVD
- FIRST EPSS
- GHSA-jm46-725r-hh9v · GitHub Advisory Database · CC BY 4.0
- CVE-2024-0450 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences