CVE-2024-8088
published 2024-08-22CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class…
PriorityP346high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSNAUNRUVXRELUX
EPSS
1.27%
66.7th percentile
There is a HIGH severity vulnerability affecting the CPython "zipfile"
module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected.
When iterating over names of entries in a zip archive (for example, methods
of "zipfile.Path" like "namelist()", "iterdir()", etc)
the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | pypy3 | < pypy3 7.3.18+dfsg-1 (forky) | pypy3 7.3.18+dfsg-1 (forky) |
| debian | python2.7 | < pypy3 7.3.18+dfsg-1 (forky) | pypy3 7.3.18+dfsg-1 (forky) |
| debian | python3.11 | < pypy3 7.3.18+dfsg-1 (forky) | pypy3 7.3.18+dfsg-1 (forky) |
| debian | python3.13 | < pypy3 7.3.18+dfsg-1 (forky) | pypy3 7.3.18+dfsg-1 (forky) |
| debian | python3.9 | < pypy3 7.3.18+dfsg-1 (forky) | pypy3 7.3.18+dfsg-1 (forky) |
| msrc | azl3_python3_3.12.3-4_on_azure_linux_3.0 | — | — |
| msrc | azl3_python3_3.12.3-5_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-7_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_python3_3.9.19-13_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-5_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| python_software_foundation | cpython | < 3.8.20 | 3.8.20 |
| python_software_foundation | cpython | >= 3.10.0 < 3.10.15 | 3.10.15 |
| python_software_foundation | cpython | >= 3.11.0 < 3.11.10 | 3.11.10 |
| python_software_foundation | cpython | >= 3.12.0 < 3.12.6 | 3.12.6 |
| python_software_foundation | cpython | >= 3.13.0a1 < 3.13.0rc2 | 3.13.0rc2 |
| python_software_foundation | cpython | >= 3.9.0 < 3.9.20 | 3.9.20 |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:X
osv8.7HIGH
vendor_debian8.7HIGH
vendor_msrc8.7HIGH
vendor_redhat8.7HIGH
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python2.7 regression
osv·2025-09-29·CVSS 5.3
CVE-2023-27043 [MEDIUM] python2.7 regression
python2.7 regression
USN-7015-4 fixed vulnerabilities in Python. It was discovered that the fix
for CVE-2023-27043 for python2.7 was incorrectly applied on Ubuntu 16.04
LTS and Ubuntu 18.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module inc
OSV
python2.7 regresssions
osv·2024-11-22·CVSS 5.3
CVE-2023-27043 [MEDIUM] python2.7 regresssions
python2.7 regresssions
USN-7015-5 fixed vulnerabilities in python2.7. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted newlines
for email headers. A remote attacker could possibly
OSV
python2.7 vulnerabilities
osv·2024-11-19·CVSS 5.3
CVE-2024-6232 [MEDIUM] python2.7 vulnerabilities
python2.7 vulnerabilities
USN-7015-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for CVE-2024-6232 and CVE-2024-6923 for python2.7
in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS
and Ubuntu 22.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email mod
OSV
python2.7, python3.5 vulnerability
osv·2024-10-14·CVSS 5.3
CVE-2023-27043 [MEDIUM] python2.7, python3.5 vulnerability
python2.7, python3.5 vulnerability
USN-7015-1 fixed several vulnerabilities in Python. This update provides the
corresponding update for CVE-2023-27043 for python2.7 and python3.5 in
Ubuntu 14.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted newlines
for email headers. A remote attacker
OSV
python2.7, python3.5 vulnerability
osv·2024-10-01·CVSS 5.3
CVE-2023-27043 [MEDIUM] python2.7, python3.5 vulnerability
python2.7, python3.5 vulnerability
USN-7015-1 fixed several vulnerabilities in Python. This update provides
the corresponding updates for CVE-2023-27043 for python2.7 in Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS, and for
python3.5 in Ubuntu 16.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the P
OSV
python3.10, python3.12, python3.8 vulnerabilities
osv·2024-09-16·CVSS 5.3
CVE-2023-27043 [MEDIUM] python3.10, python3.12, python3.8 vulnerabilities
python3.10, python3.12, python3.8 vulnerabilities
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could possibly
use this issue to bypass certain protection mechanisms. (CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue to
cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted newlines
for email headers. A remote attacker could possibly use this issue to
perform header injection. (CVE-2024-6923)
It was discovered that the Python http.cookies module incorrectly handled
parsing cookies that contained
GHSA
GHSA-q98g-hxg3-268c: There is a HIGH severity vulnerability affecting the CPython "zipfile"
module
ghsa_unreviewed·2024-08-22
CVE-2024-8088 [HIGH] CWE-835 GHSA-q98g-hxg3-268c: There is a HIGH severity vulnerability affecting the CPython "zipfile"
module
There is a HIGH severity vulnerability affecting the CPython "zipfile"
module.
When iterating over names of entries in a zip archive (for example, methods
of "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()", etc)
the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.
OSV
CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython "zipfile"
module affecting "zipfile
osv·2024-08-22·CVSS 8.7
CVE-2024-8088 [HIGH] CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython "zipfile"
module affecting "zipfile
There is a HIGH severity vulnerability affecting the CPython "zipfile"
module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected.
When iterating over names of entries in a zip archive (for example, methods
of "zipfile.Path" like "namelist()", "iterdir()", etc)
the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.
OSV
CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile
osv·2024-08-22·CVSS 8.7
CVE-2024-8088 [HIGH] CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
Ubuntu
Python 2.7 regression
vendor_ubuntu·2025-09-29·CVSS 5.3
CVE-2023-27043 [MEDIUM] Python 2.7 regression
Title: Python 2.7 regression
Summary: USN-7015-4 introduced a regression in Python 2.7
USN-7015-4 fixed vulnerabilities in Python. It was discovered that the fix
for CVE-2023-27043 for python2.7 was incorrectly applied on Ubuntu 16.04
LTS and Ubuntu 18.04 LTS. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
Ubuntu
Python regressions
vendor_ubuntu·2024-11-22·CVSS 5.3
CVE-2023-27043 [MEDIUM] Python regressions
Title: Python regressions
Summary: USN-7015-5 caused some regressions in Python.
USN-7015-5 fixed vulnerabilities in python2.7. The update introduced
several minor regressions. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted n
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-11-19·CVSS 5.3
CVE-2024-6232 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
USN-7015-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for CVE-2024-6232 and CVE-2024-6923 for python2.7
in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS
and Ubuntu 22.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
Ubuntu
Python vulnerability
vendor_ubuntu·2024-10-14·CVSS 5.3
CVE-2023-27043 [MEDIUM] Python vulnerability
Title: Python vulnerability
Summary: Python could me made to bypass some restrictions if it received specially
crafted input.
USN-7015-1 fixed several vulnerabilities in Python. This update provides the
corresponding update for CVE-2023-27043 for python2.7 and python3.5 in
Ubuntu 14.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered th
Ubuntu
Python vulnerability
vendor_ubuntu·2024-10-01·CVSS 5.3
CVE-2023-27043 [MEDIUM] Python vulnerability
Title: Python vulnerability
Summary: Python could be made to bypass some restrictions if it received specially
crafted input.
USN-7015-1 fixed several vulnerabilities in Python. This update provides
the corresponding updates for CVE-2023-27043 for python2.7 in Ubuntu 16.04
LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS, and for
python3.5 in Ubuntu 16.04 LTS.
Original advisory details:
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could
possibly use this issue to bypass certain protection mechanisms.
(CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue
to cause Python to cons
Ubuntu
Python vulnerabilities
vendor_ubuntu·2024-09-16·CVSS 5.3
CVE-2024-6923 [MEDIUM] Python vulnerabilities
Title: Python vulnerabilities
Summary: Several security issues were fixed in Python.
It was discovered that the Python email module incorrectly parsed email
addresses that contain special characters. A remote attacker could possibly
use this issue to bypass certain protection mechanisms. (CVE-2023-27043)
It was discovered that Python allowed excessive backtracking while parsing
certain tarfile headers. A remote attacker could possibly use this issue to
cause Python to consume resources, leading to a denial of service.
(CVE-2024-6232)
It was discovered that the Python email module incorrectly quoted newlines
for email headers. A remote attacker could possibly use this issue to
perform header injection. (CVE-2024-6923)
It was discovered that the Python http.cookies module incorrectly ha
Red Hat
python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service
vendor_redhat·2024-08-22·CVSS 8.7
CVE-2024-8088 [HIGH] CWE-835 python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service
python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service
There is a HIGH severity vulnerability affecting the CPython "zipfile"
module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected.
When iterating over names of entries in a zip archive (for example, methods
of "zipfile.Path" like "namelist()", "iterdir()", etc)
the process can be put into an infinite loop with a maliciously crafted
zip archive. This defect applies when reading only metadata or extracting
the contents of the zip archive. Programs that are not handling
user-controlled zip archives are not affected.
A flaw was found in Python's zipfile module. When iterating over the entries of a zip archive, the process can enter into an infinite loop state and becom
Microsoft
Infinite loop when iterating over zip archive entry names from zipfile.Path
vendor_msrc·2024-08-13·CVSS 8.7
CVE-2024-8088 [HIGH] CWE-835 Infinite loop when iterating over zip archive entry names from zipfile.Path
Infinite loop when iterating over zip archive entry names from zipfile.Path
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
PSF: PSF
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Referenc
Debian
CVE-2024-8088: pypy3 - There is a HIGH severity vulnerability affecting the CPython "zipfile" module af...
vendor_debian·2024·CVSS 8.7
CVE-2024-8088 [HIGH] CVE-2024-8088: pypy3 - There is a HIGH severity vulnerability affecting the CPython "zipfile" module af...
There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.
Scope: local
bookworm: open
bullseye: resolved
forky: resolved (fixed in 7.3.18+dfsg-1)
sid: resolved (fixed in 7.3.18+dfsg-1)
trixie: resolved (fixed in 7.3.18+dfsg-1)
No detection rules found.
No public exploits indexed.
https://github.com/python/cpython/commit/0aa1ee22ab6e204e9d3d0e9dd63ea648ed691ef1https://github.com/python/cpython/commit/2231286d78d328c2f575e0b05b16fe447d1656d6https://github.com/python/cpython/commit/795f2597a4be988e2bb19b69ff9958e981cb894ehttps://github.com/python/cpython/commit/7bc367e464ce50b956dd232c1dfa1cad4e7fb814https://github.com/python/cpython/commit/7e8883a3f04d308302361aeffc73e0e9837f19d4https://github.com/python/cpython/commit/8c7348939d8a3ecd79d630075f6be1b0c5b41f64https://github.com/python/cpython/commit/95b073bddefa6243effa08e131e297c0383e7f6ahttps://github.com/python/cpython/commit/962055268ed4f2ca1d717bfc8b6385de50a23ab7https://github.com/python/cpython/commit/9cd03263100ddb1657826cc4a71470786cab3932https://github.com/python/cpython/commit/dcc5182f27c1500006a1ef78e10613bb45788deahttps://github.com/python/cpython/commit/e0264a61119d551658d9445af38323ba94fc16dbhttps://github.com/python/cpython/commit/fc0b8259e693caa8400fa8b6ac1e494e47ea7798https://github.com/python/cpython/issues/122905https://github.com/python/cpython/issues/123270https://github.com/python/cpython/pull/122906https://mail.python.org/archives/list/[email protected]/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/http://www.openwall.com/lists/oss-security/2024/08/22/1http://www.openwall.com/lists/oss-security/2024/08/22/4http://www.openwall.com/lists/oss-security/2024/08/23/1http://www.openwall.com/lists/oss-security/2024/08/23/2https://lists.debian.org/debian-lts-announce/2024/12/msg00000.htmlhttps://security.netapp.com/advisory/ntap-20241011-0010/
2024-08-22
Published