CVE-2024-5569

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

A pathlib-compatible Zipfile object wrapper. A backport of the Path object.

Security Fix(es):

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.(CVE-2024-5569)

A pathlib-compatible Zipfile object wrapper. A backport of the Path object.

Security Fix(es):

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.(CVE-2024-5569)

A pathlib-compatible Zipfile object wrapper. A backport of the Path object.

Security Fix(es):

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.(CVE-2024-5569)

A pathlib-compatible Zipfile object wrapper. A backport of the Path object.

Security Fix(es):

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.(CVE-2024-5569)

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

Root has patched CVE-2024-5569 in the zipp package for Root:PyPI. Multiple fixed versions available.

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

Denial of Service via crafted zip file in jaraco/zipp. (CVE-2024-5569)

These are all security issues fixed in the python310-zipp-3.19.2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-zipp-4.1.0-1.2 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Fixed failing x509 tests with OpenSSL < 1.1
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Allow NamedLoaderContexts to be returned from loader
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Prevent using SyncWrapper with no reason
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Increase warn_until_date date for code we still support
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Improved error handling with different OpenSSL versions
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Use Pygit2 id instead of deprecated oid in gitfs
  • Added passlib Python module to the bundle

This update for python-zipp fixes the following issues:

• CVE-2024-5569: Fixed DoS vulnerability when processing a specially crafted zip file (bsc#1227547).

This update for python-zipp fixes the following issues:

• CVE-2024-5569: Fixed DoS vulnerability when processing a specially crafted zip file (bsc#1227547).

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Added passlib Python module to the bundle
  • Allow NamedLoaderContexts to be returned from loader
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Fixed failing x509 tests with OpenSSL < 1.1
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Fixed zyppnotify plugin after latest zypp/libzypp upgrades (bsc#1231697, bsc#1231045)
  • Improved error handling with different OpenSSL versions
  • Increase warn_until_date date for code we still support
  • Prevent using SyncWrapper with no reason
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Use Pygit2 id instead of deprecated oid in gitfs

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Added passlib Python module to the bundle
  • Allow NamedLoaderContexts to be returned from loader
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Fixed failing x509 tests with OpenSSL < 1.1
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Fixed too frequent systemd service restart in test_system test
  • Fixed zyppnotify plugin after latest zypp/libzypp upgrades (bsc#1231697, bsc#1231045)
  • Improved error handling with different OpenSSL versions
  • Increase warn_until_date date for code we still support
  • Prevent using SyncWrapper with no reason
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Use Pygit2 id instead of deprecated oid in gitfs

This update fixes the following issues:

venv-salt-minion:

• Security fixes on Python 3.11 interpreter:

  • CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes (bsc#1229873, bsc#1230059)
  • CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path (bsc#1229704, bsc#1230058)
  • CVE-2024-6923: Prevent email header injection due to unquoted newlines (bsc#1228780)
  • CVE-2024-4032: Rearranging definition of private global IP addresses (bsc#1226448)
  • CVE-2024-0397: ssl.SSLContext.cert_store_stats() and ssl.SSLContext.get_ca_certs() now correctly lock access to the certificate store, when the ssl.SSLContext is shared across multiple threads (bsc#1226447)

• Security fixes on Python dependencies:

  • CVE-2024-5569: zipp: Fixed a Denial of Service (DoS) vulnerability in the jaraco/zipp library (bsc#1227547, bsc#1229996)
  • CVE-2024-6345: setuptools: Sanitize any VCS URL used for download (bsc#1228105, bsc#1229995)
  • CVE-2024-3651: idna: Fix a potential DoS via resource consumption via specially crafted inputs to idna.encode() (bsc#1222842, bsc#1229994)
  • CVE-2024-37891: urllib3: Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host (bsc#1226469, bsc#1229654)

• Other bugs fixed:

  • Fixed failing x509 tests with OpenSSL < 1.1
  • Avoid explicit reading of /etc/salt/minion (bsc#1220357)
  • Allow NamedLoaderContexts to be returned from loader
  • Reverted the change making reactor less blocking (bsc#1230322)
  • Use --cachedir for extension_modules in salt-call (bsc#1226141)
  • Prevent using SyncWrapper with no reason
  • Enable post_start_cleanup.sh to work in a transaction
  • Fixed the SELinux context for Salt Minion service (bsc#1219041)
  • Increase warn_until_date date for code we still support
  • Avoid crash on wrong output of systemctl version (bsc#1229539)
  • Improved error handling with different OpenSSL versions
  • Fixed cloud Minion configuration for multiple Masters (bsc#1229109)
  • Use Pygit2 id instead of deprecated oid in gitfs
  • Added passlib Python module to the bundle

It was discovered that python-zipp did not properly handle the zip files with malformed names. An attacker could possibly use this issue to cause a denial of service.