GHSA-q5fm-55c2-v6j9
Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib
Summary
Vulnerability scan of fiona shows CVE-2023-45853. The vulnerability is in GDAL, a dependency of fiona.
Details
Fiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.
The Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.
Impact
Systems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score used
Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib
Summary
Vulnerability scan of fiona shows CVE-2023-45853. The vulnerability is in GDAL, a dependency of fiona.
Details
Fiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.
The Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.
Impact
Systems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.
- Record
GHSA-q5fm-55c2-v6j9- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190, CWE-1395
- Updated
- 2026-11-02
OSV
Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib
Summary
Vulnerability scan of fiona shows CVE-2023-45853. The vulnerability is in GDAL, a dependency of fiona.
Details
Fiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.
The Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.
Impact
Systems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.
- Record
GHSA-q5fm-55c2-v6j9- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-1395, CWE-190
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
fionaPyPI | before 1.10b1 | 1.10b1 |
fionaPyPI | before 1.10b1, plus listed versions 0.100.120.12.10.130.14 Show 45 moreShow less0.150.160.16.10.50.60.6.10.6.20.70.80.90.9.11.01.0.11.0.21.0.31.11.1.11.1.21.1.31.1.41.1.51.1.61.10a11.10a21.2.01.3.01.4.01.4.11.4.21.4.31.4.41.4.51.4.61.4.71.4.81.5.01.5.11.6.01.6.11.6.21.6.31.6.3.post11.6.41.7.01.7.0.post1 | 1.10b1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-q5fm-55c2-v6j9 is a critical vulnerability (CVSS 9.3) in fiona, published July 16, 2024. No source lists public exploit code. Fixed in fiona 1.10b1.
References
github.com/Toblerity/Fiona/security/advisories/GHSA-q5fm-55c2-v6j9
nvd.nist.gov/vuln/detail/CVE-2023-45853
Left out here: 61 versions. The JSON record has them.