{"id":"GHSA-q5fm-55c2-v6j9","aliases":[],"status":"published","title":"Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib","description":"### Summary\nVulnerability scan of fiona shows [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853). The vulnerability is in GDAL, a dependency of fiona.\n\n### Details\nFiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.\n\nThe Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.\n\n### Impact\nSystems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395","CWE-190"],"published":"2024-07-16T19:32:45Z","modified":"2024-12-01T05:44:08Z","fixes":[{"ecosystem":"PyPI","package":"fiona","fixed_in":["1.10b1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"fiona","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10b1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"fiona","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10b1"}]}],"versions":["0.10","0.12","0.12.1","0.13","0.14","0.15","0.16","0.16.1","0.5","0.6","0.6.1","0.6.2","0.7","0.8","0.9","0.9.1","1.0","1.0.1","1.0.2","1.0.3","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.10a1","1.10a2","1.2.0","1.3.0","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.5.0","1.5.1","1.6.0","1.6.1","1.6.2","1.6.3","1.6.3.post1","1.6.4","1.7.0","1.7.0.post1","1.7.0.post2","1.7.1","1.7.1.post1","1.7.10","1.7.10.post1","1.7.11","1.7.11.post1","1.7.11.post2","1.7.12","1.7.13","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.7.9.post1","1.8.0","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.13.post1","1.8.14","1.8.15","1.8.16","1.8.17","1.8.18","1.8.19","1.8.2","1.8.20","1.8.21","1.8.22","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8.9.post1","1.8.9.post2","1.8b1","1.8b2","1.8rc1","1.9.0","1.9.1","1.9.2","1.9.3","1.9.4","1.9.4.post1","1.9.5","1.9.6","1.9a1","1.9a2","1.9a3","1.9b1","1.9b2"]}],"references":[{"url":"https://github.com/Toblerity/Fiona/security/advisories/GHSA-q5fm-55c2-v6j9","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45853","tags":["advisory"]},{"url":"https://github.com/OSGeo/gdal/commit/4aa7ca61c1d2191baf1eea2a97d0dec33a41691f","tags":["web"]},{"url":"https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q5fm-55c2-v6j9"},{"url":"https://github.com/Toblerity/Fiona","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-q5fm-55c2-v6j9","title":"Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib","description":"### Summary\nVulnerability scan of fiona shows [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853). The vulnerability is in GDAL, a dependency of fiona.\n\n### Details\nFiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.\n\nThe Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.\n\n### Impact\nSystems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.","status":"published","published":"2024-07-16T19:32:45Z","modified":"2024-08-21T22:30:06Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190","CWE-1395"],"updated_at":"2026-11-02T14:37:59.336921Z"}],"osv":[{"id":"GHSA-q5fm-55c2-v6j9","title":"Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib","description":"### Summary\nVulnerability scan of fiona shows [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853). The vulnerability is in GDAL, a dependency of fiona.\n\n### Details\nFiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.\n\nThe Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.\n\n### Impact\nSystems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.","status":"published","published":"2024-07-16T19:32:45Z","modified":"2024-12-01T05:44:08.770874Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-1395","CWE-190"],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}