Red Hat Security Advisory: RHOSP 17.1.4 (python-zipp) security update

Fixed packages 2

Vulnerabilities 1

• Medium 6.2
  CVE-2024-5569

  Denial of Service via crafted zip file in jaraco/zipp

  A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile …

  jaraco jaraco/zipp kubeflow-pipelines-apiserver tensorflow Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jul 9, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2296413
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9977.json
• report
  https://access.redhat.com/security/cve/CVE-2024-5569
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-5569
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-5569
• article
  https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd
• article
  https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae