Read the docs
TI-2024-05174 Aliases CVE-2024-5569GHSA-jfmj-5v4g-7637

Denial of Service via crafted zip file in jaraco/zipp

Priority LOW 27CWE-835Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 3 without a fix

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.

Summary

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Partial jaraco/zipp (jaraco): 3.19.1zipp (PyPI): 3.19.1Red Hat: 5 advisoriesRed Hat: 7 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
jaracojaraco/zippbefore 3.19.13.19.1Patch availableCNA
—zipp (PyPI)before 3.19.13.19.1Patch availableGHSA-jfmj-5v4g-7637
  • jaraco/zipp Vendorjaraco Affected before 3.19.1 Fixed in 3.19.1 Patch available CNA
  • zipp (PyPI) Vendor— Affected before 3.19.1 Fixed in 3.19.1 Patch available GHSA-jfmj-5v4g-7637

Remediation

  • Fix · CNA jaraco/zipp (jaraco) Fixed in 3.19.1
  • Fix · GHSA-jfmj-5v4g-7637 zipp (PyPI) Fixed in 3.19.1 Advisory →

Red Hat 5 advisories

  • RHSA-2024:9977 Released 2024-11-21 · Red Hat rating Moderate
    RHOSP 17.1.4 (python-zipp) security update
    • Red Hat OpenStack Platform 17.1 python-zipp-3.4.0-3.el9ost, python3-zipp-3.4.0-3.el9ost
  • RHSA-2024:8906 Released 2024-11-05 · Red Hat rating Critical
    Satellite 6.16.0 release
    • Red Hat Satellite 6.16 for RHEL 8 ansible-collection-redhat-satellite-4.2.0-1.el8sat, ansible-collection-redhat-satellite_operations-3.0.0-1.el8sat, ansible-lint-5.4.0-1.el8pc +47
    • Red Hat Satellite 6.16 for RHEL 9 ansible-collection-redhat-satellite-4.2.0-1.el9sat, ansible-collection-redhat-satellite_operations-3.0.0-1.el9sat, ansible-runner-2.2.1-5.el9pc +47
  • RHSA-2024:8418 Released 2024-10-30 · Red Hat rating Moderate
    OpenShift Container Platform 4.16.z security update
    • Ironic content for Red Hat OpenShift Container Platform 4.16 python-zipp-3.19.1-1.el9, python3-zipp-3.19.1-1.el9
    • Red Hat OpenShift Container Platform 4.16 cri-o-1.29.9-6.rhaos4.16.gite7bd45a.el8, cri-o-1.29.9-6.rhaos4.16.gite7bd45a.el9
Show 2 more Red Hat advisories
  • RHSA-2024:8232 Released 2024-10-23 · Red Hat rating Important
    OpenShift Container Platform 4.17.2 packages and security update
    • Ironic content for Red Hat OpenShift Container Platform 4.17 python-zipp-3.19.1-1.el9, python3-zipp-3.19.1-1.el9
    • Red Hat OpenShift Container Platform 4.17 containernetworking-plugins-1:1.4.0-4.rhaos4.17.el8, podman-4:5.2.3-2.rhaos4.17.el8, podman-4:5.2.3-2.rhaos4.17.el9 +14
  • RHSA-2024:6428 Released 2024-09-05 · Red Hat rating Moderate
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-4.5.10-1.el8ap, automation-controller-cli-4.5.10-1.el8ap, automation-controller-server-4.5.10-1.el8ap +7
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-4.5.10-1.el9ap, automation-controller-cli-4.5.10-1.el9ap, automation-controller-server-4.5.10-1.el9ap +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 18.0AffectedNo fix yet
Red Hat Update Infrastructure 4 for Cloud ProvidersAffectedNo fix planned: Will not fix
Ironic content for Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:8418
Ironic content for Red Hat OpenShift Container Platform 4.17Fixed RHSA-2024:8232
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2024:6428
Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed RHSA-2024:6428
Red Hat OpenStack Platform 17.1Fixed RHSA-2024:9977
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2024:8906
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2024:8906
Not affected: 6 products
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-5569
  2. 2026-10-03 Alias added: GHSA-jfmj-5v4g-7637

References

Advisory 1

Other 3

  • TI-2026-19291 jaraco.context Has a Path Traversal Vulnerability CVSS 3.1HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences