jaraco zipp up to 3.19.0 ZIP File resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, was found in jaraco zipp up to 3.19.0. Affected by this issue is some unknown functionality of the component ZIP File Handler. Such manipulation leads to resource consumption. This vulnerability is traded as CVE-2024-5569. An attack has to be approached locally. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in jaraco zipp up to 3.19.0. Affected by this issue is some unknown functionality of the component ZIP File Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

The advisory is shared for download at huntr.com. This vulnerability is handled as CVE-2024-5569 since 05/31/2024. The exploitation is known to be easy. The attack needs to be approached locally. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 209548 (RHEL 8 / 9 : OpenShift Container Platform 4.17.2 (RHSA-2024:8232)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.19.1 eliminates this vulnerability. Applying the patch fd604bd34f0343472521a36da1fbd22e793e14fd is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (209548). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• jaraco

Name

• zipp

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19.0

License

• open-source

Website

• Product: https://github.com/jaraco/zipp/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion