Python 'zipfile' Module Vulnerability (Oct 2025) - Windows

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:python:python";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.119140");
  script_version("2025-12-18T05:46:55+0000");
  script_tag(name:"last_modification", value:"2025-12-18 05:46:55 +0000 (Thu, 18 Dec 2025)");
  script_tag(name:"creation_date", value:"2025-10-08 13:56:53 +0000 (Wed, 08 Oct 2025)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:P/A:N");

  script_cve_id("CVE-2025-8291");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Python 'zipfile' Module Vulnerability (Oct 2025) - Windows");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("General");
  script_dependencies("gb_python_consolidation.nasl", "os_detection.nasl");
  script_mandatory_keys("python/detected", "Host/runs_windows");

  script_tag(name:"summary", value:"Python is prone to a vulnerability in the 'zipfile' module.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The 'zipfile' module would not check the validity of the ZIP64
  End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64
  EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP
  archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile'
  module compared to other ZIP implementations. Remediation maintains this behavior, but checks that
  the offset specified in the ZIP64 EOCD Locator record matches the expected value.");

  script_tag(name:"affected", value:"Python prior to version 3.9.24, 3.10.x prior to 3.10.19, 3.11.x
  prior to 3.11.14, 3.12.x prior to 3.12.12, 3.13.x prior to 3.13.10 and 3.14.x prior to 3.14.1.");

  script_tag(name:"solution", value:"Update to version 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.10,
  3.14.1 or later.");

  script_xref(name:"URL", value:"https://mail.python.org/archives/list/[email protected]/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/");
  script_xref(name:"URL", value:"https://github.com/python/cpython/issues/139700");
  script_xref(name:"URL", value:"https://github.com/python/cpython/pull/139702");
  script_xref(name:"URL", value:"https://github.com/python/cpython/pull/139706");
  script_xref(name:"URL", value:"https://github.com/python/cpython/pull/139708");
  script_xref(name:"URL", value:"https://github.com/python/cpython/pull/139712");
  script_xref(name:"URL", value:"https://github.com/python/cpython/pull/139713");
  script_xref(name:"URL", value:"https://github.com/python/cpython/pull/139714");
  script_xref(name:"URL", value:"https://github.com/python/cpython/pull/139715");
  script_xref(name:"URL", value:"https://osv.dev/vulnerability/PSF-2025-12");
  # nb: The PSF seems to publish the affected / fixed versions in the "Product Status" part of
  # these since some time. So even it is a more generic link this should / will be always included.
  script_xref(name:"URL", value:"https://www.cve.org/CVERecord?id=CVE-2025-8291");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE,
                                          version_regex: "^[0-9]+\.[0-9]+\.[0-9]+"))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "3.9.24")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.9.24", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.10", test_version_up: "3.10.19")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.10.19", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.11", test_version_up: "3.11.14")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.11.14", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.12", test_version_up: "3.12.12")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.12.12", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.13", test_version_up: "3.13.10")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.13.10", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "3.14", test_version_up: "3.14.1")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.14.1", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);