Every CVE Search/ Get API key

CVE-2013-7338

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and...

7.1 HighFix available

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.

Exploit likelihood

5.05%Up 3.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.1

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.

Record
CVE-2013-7338
CVSS 2.0
7.1 HighAV:N/AC:M/Au:N/C:N/I:N/A:C
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.

Record
CVE-2013-7338
Updated
2026-11-02
EUVDEUVD-2013-7111 No score

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.

Record
EUVD-2013-7111
Updated
2026-11-03
GitHub AdvisoriesGHSA-hr8p-cf7x-v483 No score

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and...

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.

Record
GHSA-hr8p-cf7x-v483
Weakness
CWE-20
Updated
2026-11-02
OSVMGASA-2014-0140 No score

Updated python3 package fixes security vulnerabilities

ZipExtFile.read goes into 100% CPU infinite loop on maliciously binary edited zips (CVE-2013-7338).

Record
MGASA-2014-0140
Updated
2026-11-02
OSVPSF-2014-3 No score

zipfile DoS using invalid file size

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.

Record
PSF-2014-3
Updated
2026-11-02
OSVUBUNTU-CVE-2013-7338 No score

Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.

Record
UBUNTU-CVE-2013-7338
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python3
Mageia:3
 before 3.3.0-4.7.mga3
3.3.0-4.7.mga3
python3
Mageia:4
 before 3.3.2-13.2.mga4
3.3.2-13.2.mga4

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-7338 is a high vulnerability (CVSS 7.1) in Python, published March 24, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.05%, the 92nd percentile. Fixed in python3 3.3.0-4.7.mga3.

References

Show 12 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open