CVE-2013-7338 Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read,....
HighCVSS 7.1
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| python | = 3.3.0 | No fix listed |
| python | = 3.3.0-alpha1 | No fix listed |
| python | = 3.3.0-alpha2 | No fix listed |
| python | = 3.3.0-alpha3 | No fix listed |
| python | = 3.3.0-alpha4 | No fix listed |
| python | = 3.3.0-beta1 | No fix listed |
| python | = 3.3.0-beta2 | No fix listed |
| python | = 3.3.0-rc1 | No fix listed |
| python | = 3.3.0-rc2 | No fix listed |
| python | = 3.3.0-rc3 | No fix listed |
| python | = 3.3.1 | No fix listed |
| python | = 3.3.1-rc1 | No fix listed |
| python | = 3.3.2 | No fix listed |
| python | = 3.3.3 | No fix listed |
| python | = 3.3.3-rc1 | No fix listed |
| python | = 3.3.3-rc2 | No fix listed |
| apple mac os x | <= 10.10.4 | No fix listed |
References
- bugs.python.org exploit patch vendor-advisory
- hg.python.org exploit patch vendor-advisory
- APPLE-SA-2015-08-13-2 mailing-list vendor-advisory
- openSUSE-SU-2014:0597 mailing-list third-party-advisory vendor-advisory
- [oss-security] 20140318 CVE request for python/zipfile mailing-list third-party-advisory
- [oss-security] 20140319 Re: CVE request for python/zipfile mailing-list third-party-advisory
- 65179 third-party-advisory vdb-entry
- 1029973 third-party-advisory vdb-entry
- docs.python.org vendor-advisory
- GLSA-201503-10 third-party-advisory vendor-advisory
- support.apple.com patch vendor-advisory