CVE-2019-9674

Public on 2020-02-04
Modified on 2023-02-22
Description
Lib/zipfile.py in Python allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb. The Python community has provided a documentation update on this issue [1].

[1] https://python-security.readthedocs.io/security.html#archives-and-zip-bomb-cve-2019-9674
Severity
Important severity
Important
CVSS v3 Base Score
7.5
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core python No Fix Planned
Amazon Linux 1 python27 No Fix Planned
Amazon Linux 2 - Core python3 No Fix Planned
Amazon Linux 2023 python3.10 No Fix Planned
Amazon Linux 1 python35 No Fix Planned
Amazon Linux 1 python36 No Fix Planned
Amazon Linux 1 python38 No Fix Planned
Amazon Linux 2 - Core python38 No Fix Planned

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD CVSSv2 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P
NVD CVSSv3 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H