Description
Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.
References
- [oss-security] 20140318 CVE request for python/zipfile mailing-list
- 65179 vdb-entry
- openSUSE-SU-2014:0597 vendor-advisory
- http://hg.python.org/cpython/rev/79ea4ce431b1
- GLSA-201503-10 vendor-advisory
- APPLE-SA-2015-08-13-2 vendor-advisory
- http://bugs.python.org/issue20078
- [oss-security] 20140319 Re: CVE request for python/zipfile mailing-list
- https://support.apple.com/kb/HT205031
- 1029973 vdb-entry
- https://docs.python.org/3.3/whatsnew/changelog.html