Security Bulletin: Zipp Path Module Denial of Service via Malformed ZIP File

Summary zipp is vulnerable to a denial of service, caused by an infinite loop flaw in the Path module. By using a specially crafted zip file, a local attacker could exploit this vulnerability to cause a denial of service condition. Vulnerability Details CVEID:CVE-2024-5569 DESCRIPTION: zipp is...

Security Bulletin: Vulnerability in zipp affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2024-5569].

Summary The zipp package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2024-5569. Vulnerability Details CVEID:CVE-2024-5569 DESCRIPTION: zipp is vulnerable to a denial of service, caused by an infinite loop flaw in the Path...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in zipp

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of zipp. Vulnerability Details CVEID:CVE-2024-5569 DESCRIPTION: zipp is vulnerable to a denial of service, caused by an infinite loop flaw in the Path module. By using a specially crafted zip file, a local attacker could...

Security Bulletin: Vulnerability in zipp affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0) [CVE-2024-5569]

Summary The zipp package is used by IBM Cloud Pak for Data System 2.0 . IBM Cloud Pak for Data System 2.0 has addressed the applicable CVEs CVE-2024-5569. Vulnerability Details CVEID:CVE-2024-5569 DESCRIPTION: zipp is vulnerable to a denial of service, caused by an infinite loop flaw in the Path...

Security update for SUSE Manager Client Tools and Salt Bundle

This update for SUSE Manager Client Tools and Salt Bundle the following issues: uyuni-tools: venv-salt-minion: Security fixes on Python 3.11 interpreter: CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes bsc1229873, bsc1230059 CVE-2024-8088: Prevent...

Security Bulletin: Vulnerability in zipp affects watsonx.data

Summary zipp is vulnerable to a denial of service attack, which could affect watsonx.data. Vulnerability Details CVEID:CVE-2024-5569 DESCRIPTION: zipp is vulnerable to a denial of service, caused by an infinite loop flaw in the Path module. By using a specially crafted zip file, a local attacker...

Security update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: Security fixes on Python 3.11 interpreter: CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes bsc1229873, bsc1230059 CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path...

Security update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: Security fixes on Python 3.11 interpreter: CVE-2024-7592: Fixed quadratic complexity in parsing -quoted cookie values with backslashes bsc1229873, bsc1230059 CVE-2024-8088: Prevent malformed payload to cause infinite loops in zipfile.Path...

Security Bulletin: IBM Maximo Application Suite - Predict Component component uses zipp-3.15.0-py3-none-any.whl which is vulnerable to this CVE-2024-5569

Summary Security Bulletin: IBM Maximo Application Suite - Predict Component component uses zipp-3.15.0-py3-none-any.whl which is vulnerable to this CVE-2024-5569 Vulnerability Details CVEID:CVE-2024-5569 DESCRIPTION: zipp is vulnerable to a denial of service, caused by an infinite loop flaw in th...

The vulnerability of the jaraco/zipp library, which is compatible with the pathlib API of the Zipfile library, allows a attacker to cause a service failure.

The vulnerability of the jaraco/zipp library, which is compatible with the pathlib API of the Zipfile library, relates to the processing of specially created zip files. This can lead to an infinite loop. Exploiting this vulnerability could allow a attacker to cause a service failure...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : python-zipp vulnerability (USN-6906-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6906-1 advisory. It was discovered that python-zipp did not properly handle the zip files with malformed names. An attacker could possibly use this issue t...

a2grunnerp (>=0.1.0 <=0.1.8), abuseipdb-wrapper (=0.1.7) +653 more potentially affected by CVE-2024-5569 via zipp (>=0.3.3 <=3.19.0)

zipp PYPI version =0.3.3, =0.1.0, =0.0.5, =0.0.1, =0.29.0, =0.0.3.20, =0.0.1, =0.1.23, =0.20.0, =0.21.0 and more Source cves: CVE-2024-5569 Source advisory: OSV:GHSA-JFMJ-5V4G-7637...

AZL-43198 CVE-2024-5569 affecting package python-zipp for versions less than 3.17.0-3

A Denial of Service DoS vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the...

zipp Resource Management Error Vulnerability

zipp is a pathlib-compatible wrapper for Zipfile objects by Jason R. Coombs, a personal developer. A resource management error vulnerability exists in zipp versions prior to 3.19.1, which stems from the fact that specially crafted zip files can lead to an infinite loop, which in turn can lead to ...