CVE catalog

CVE-2024-0450

python3.11: CVE-2024-0450

[CVE catalog]

Severity
Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpypy3sid8.0.1+dfsg-1fixed
Debianpypy3forky8.0.1+dfsg-1fixed
Debianpypy3trixie7.3.19+dfsg-2fixed
Debianpypy3bookworm7.3.11+dfsg-2+deb12u3fixed
Debianpython3.11bookworm3.11.2-6+deb12u8fixed
Debianpython3.11bookworm-security3.11.2-6+deb12u9fixed
Alpinepython33.163.10.14-r0fixed
Alpinepython33.173.10.14-r0fixed
Ubuntupython3.5pro3.5.0-3vulnerable
Ubuntupython3.5pro3.5.0-3ubuntu1vulnerable
Ubuntupython3.5pro3.5.1~rc1-2ubuntu1vulnerable
Ubuntupython3.5pro3.5.1-1vulnerable
Ubuntupython3.5pro3.5.1-2vulnerable
Ubuntupython3.5pro3.5.1-3vulnerable
Ubuntupython3.5pro3.5.1-5vulnerable
Ubuntupython3.5pro3.5.1-6ubuntu1vulnerable
Ubuntupython3.5pro3.5.1-6ubuntu2vulnerable
Ubuntupython3.5pro3.5.1-9ubuntu1vulnerable
Ubuntupython3.5pro3.5.1-10vulnerable
Ubuntupython3.5pro3.5.2-2~16.01vulnerable
Ubuntupython3.5pro3.5.2-2~16.04vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.1vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.2vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.3vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.4vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.5vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.8vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.9vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.10vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.11vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.12vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm1vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm2vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm3vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm5vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm6vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm7vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm8vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm9vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm10vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm11vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm12vulnerable
Ubuntupython3.5pro3.5.2-2ubuntu0~16.04.13+esm13fixed
Ubuntupython2.7pro2.7.18-8build1vulnerable
Ubuntupython2.7pro2.7.18-13vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.1vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.1+esm2vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.2vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.2+esm1vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.2+esm2vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.2+esm3vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.3vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.3+esm1vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.4vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.4+esm1vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.5vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.5+esm2vulnerable
Ubuntupython2.7pro2.7.18-13ubuntu1.5+esm3fixed
Ubuntupython3.4pro3.4~b1-0ubuntu3vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu4vulnerable
Ubuntupython3.4pro3.4~b1-4ubuntu6vulnerable
Ubuntupython3.4pro3.4~b1-5ubuntu2vulnerable
Ubuntupython3.4pro3.4~b2-1vulnerable
Ubuntupython3.4pro3.4~b3-1ubuntu1vulnerable
Ubuntupython3.4pro3.4~rc1-1build1vulnerable
Ubuntupython3.4pro3.4~rc2-1vulnerable
Ubuntupython3.4pro3.4~rc3-0ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1vulnerable
Ubuntupython3.4pro3.4.0-2ubuntu1.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.1vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.3vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.4vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.5vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.6vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm2vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm4vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm6vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm7vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm8vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm10vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm11vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm12vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm13vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm14vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm15vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm16vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm17vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm19vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm20vulnerable
Ubuntupython3.4pro3.4.3-1ubuntu1~14.04.7+esm21vulnerable
Ubuntupython3.6pro3.6.3-1ubuntu1vulnerable
Ubuntupython3.6pro3.6.4~rc1-1vulnerable
Ubuntupython3.6pro3.6.4~rc1-2vulnerable
Ubuntupython3.6pro3.6.4-1vulnerable
Ubuntupython3.6pro3.6.4-2vulnerable
Ubuntupython3.6pro3.6.4-3build1vulnerable
Ubuntupython3.6pro3.6.4-4vulnerable
Ubuntupython3.6pro3.6.5~rc1-1vulnerable
Ubuntupython3.6pro3.6.5-3vulnerable
Ubuntupython3.6pro3.6.6-1~18.04vulnerable
Ubuntupython3.6pro3.6.7-1~18.04vulnerable
Ubuntupython3.6pro3.6.8-1~18.04.1vulnerable
Ubuntupython3.6pro3.6.8-1~18.04.2vulnerable
Ubuntupython3.6pro3.6.8-1~18.04.3vulnerable
Ubuntupython3.6pro3.6.9-1~18.04vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.1vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.3vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.4vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.6vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.7vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.8vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.9vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.10vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.12vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.13vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.13+esm1vulnerable
Ubuntupython3.6pro3.6.9-1~18.04ubuntu1.13+esm2fixed
Ubuntupython3.7pro3.7.0~a2-1vulnerable
Ubuntupython3.7pro3.7.0~a3-1vulnerable
Ubuntupython3.7pro3.7.0~a3-2vulnerable
Ubuntupython3.7pro3.7.0~a3-3vulnerable
Ubuntupython3.7pro3.7.0~a4-1vulnerable
Ubuntupython3.7pro3.7.0~b1-1vulnerable
Ubuntupython3.7pro3.7.0~b1-1build1vulnerable
Ubuntupython3.7pro3.7.0~b2-1vulnerable
Ubuntupython3.7pro3.7.0~b3-1vulnerable
Ubuntupython3.7pro3.7.0-1~18.04vulnerable
Ubuntupython3.7pro3.7.1-1~18.04vulnerable
Ubuntupython3.7pro3.7.3-2~18.04.1vulnerable
Ubuntupython3.7pro3.7.5-2~18.04vulnerable
Ubuntupython3.7pro3.7.5-2~18.04.4vulnerable
Ubuntupython3.7pro3.7.5-2ubuntu1~18.04.2vulnerable
Ubuntupython3.7pro3.7.5-2ubuntu1~18.04.2+esm1vulnerable
Ubuntupython3.7pro3.7.5-2ubuntu1~18.04.2+esm2vulnerable
Ubuntupython3.7pro3.7.5-2ubuntu1~18.04.2+esm3fixed
Ubuntupython3.8pro3.8.0-3~18.04vulnerable
Ubuntupython3.8pro3.8.0-3~18.04.1vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm1vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm2fixed
Ubuntupython3.820.043.8.0-1vulnerable
Ubuntupython3.820.043.8.0-2vulnerable
Ubuntupython3.820.043.8.0-3vulnerable
Ubuntupython3.820.043.8.0-4vulnerable
Ubuntupython3.820.043.8.0-5vulnerable
Ubuntupython3.820.043.8.1-2ubuntu3vulnerable
Ubuntupython3.820.043.8.2~rc1-1ubuntu1vulnerable
Ubuntupython3.820.043.8.2-1vulnerable
Ubuntupython3.820.043.8.2-1ubuntu1vulnerable
Ubuntupython3.820.043.8.2-1ubuntu1.1vulnerable
Ubuntupython3.820.043.8.2-1ubuntu1.2vulnerable
Ubuntupython3.820.043.8.5-1~20.04vulnerable
Ubuntupython3.820.043.8.5-1~20.04.2vulnerable
Ubuntupython3.820.043.8.5-1~20.04.3vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.1vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.2vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.4vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.5vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.6vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.7vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.8vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.9vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.10fixed
Ubuntupython3.9pro3.9.0~rc1-1~20.04vulnerable
Ubuntupython3.9pro3.9.0-5~20.04vulnerable
Ubuntupython3.9pro3.9.5-3~20.04.1vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm1vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm2fixed
Ubuntupython3.1022.043.10.0-2vulnerable
Ubuntupython3.1022.043.10.0-3vulnerable
Ubuntupython3.1022.043.10.0-4vulnerable
Ubuntupython3.1022.043.10.0-5vulnerable
Ubuntupython3.1022.043.10.0-5build1vulnerable
Ubuntupython3.1022.043.10.1-1vulnerable
Ubuntupython3.1022.043.10.1-2vulnerable
Ubuntupython3.1022.043.10.2-1vulnerable
Ubuntupython3.1022.043.10.2-5vulnerable
Ubuntupython3.1022.043.10.2-7vulnerable
Ubuntupython3.1022.043.10.3-1vulnerable
Ubuntupython3.1022.043.10.4-3vulnerable
Ubuntupython3.1022.043.10.4-3ubuntu0.1vulnerable
Ubuntupython3.1022.043.10.6-1~22.04vulnerable
Ubuntupython3.1022.043.10.6-1~22.04.1vulnerable
Ubuntupython3.1022.043.10.6-1~22.04.2vulnerable
Ubuntupython3.1022.043.10.6-1~22.04.2ubuntu1vulnerable
Ubuntupython3.1022.043.10.6-1~22.04.2ubuntu1.1vulnerable
Ubuntupython3.1022.043.10.12-1~22.04.2vulnerable
Ubuntupython3.1022.043.10.12-1~22.04.3vulnerable
Ubuntupython3.1022.043.10.12-1~22.04.4fixed
Ubuntupython3.11pro3.11.0~rc1-1~22.04vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1~esm1fixed
Opensusepythontumbleweed2.7.18-47.1fixed
Susepython3linux enterprise module for web and scripting 123.4.10-25.130.1fixed
Susepython3-baselinux enterprise module for web and scripting 123.4.10-25.130.1fixed
Susepython3linux enterprise software development kit 12 sp53.4.10-25.130.1fixed
Susepython3-baselinux enterprise software development kit 12 sp53.4.10-25.130.1fixed
Susepython3linux enterprise server 12 sp53.4.10-25.130.1fixed
Susepython3-baselinux enterprise server 12 sp53.4.10-25.130.1fixed
Susepython3linux enterprise server for sap applications 12 sp53.4.10-25.130.1fixed
Susepython3-baselinux enterprise server for sap applications 12 sp53.4.10-25.130.1fixed
Susepythonlinux enterprise server 12 sp52.7.18-33.35.1fixed
Susepython-baselinux enterprise server 12 sp52.7.18-33.35.1fixed
Susepython-doclinux enterprise server 12 sp52.7.18-33.35.1fixed
Susepythonlinux enterprise server for sap applications 12 sp52.7.18-33.35.1fixed
Susepython-baselinux enterprise server for sap applications 12 sp52.7.18-33.35.1fixed
Susepython-doclinux enterprise server for sap applications 12 sp52.7.18-33.35.1fixed
Susepython-baselinux enterprise workstation extension 12 sp52.7.18-33.35.1fixed
Opensusepython311tumbleweed3.11.8-5.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpypy3sourcesid7.3.16+dfsg-1not yet assignedNot reportedNot reported
Debianpypy3sourceforky7.3.16+dfsg-1not yet assignedNot reportedNot reported
Debianpypy3sourcetrixie7.3.16+dfsg-1not yet assignedNot reportedNot reported
Debianpypy3sourcebookworm7.3.11+dfsg-2+deb12u2not yet assignedNot reportedNot reported
Debianpython3.11sourcebookworm3.11.2-6+deb12u2not yet assignedNot reported[1070133]
Alpinepython3apk3.163.10.14-r0Not reportedALPINE-CVE-2024-0450Not reported
Alpinepython3apk3.173.10.14-r0Not reportedALPINE-CVE-2024-0450Not reported
Ubuntupython3.5debpro3.5.2-2ubuntu0~16.04.13+esm13Not reportedUBUNTU-CVE-2024-0450Not reported
Ubuntupython2.7debpro2.7.18-13ubuntu1.5+esm3Not reportedUBUNTU-CVE-2024-0450Not reported
Ubuntupython3.6debpro3.6.9-1~18.04ubuntu1.13+esm2Not reportedUBUNTU-CVE-2024-0450Not reported
Ubuntupython3.7debpro3.7.5-2ubuntu1~18.04.2+esm3Not reportedUBUNTU-CVE-2024-0450Not reported
Ubuntupython3.8debpro3.8.0-3ubuntu1~18.04.2+esm2Not reportedUBUNTU-CVE-2024-0450Not reported
Ubuntupython3.8deb20.043.8.10-0ubuntu1~20.04.10Not reportedUBUNTU-CVE-2024-0450Not reported
Ubuntupython3.9debpro3.9.5-3ubuntu0~20.04.1+esm2Not reportedUBUNTU-CVE-2024-0450Not reported
Ubuntupython3.10deb22.043.10.12-1~22.04.4Not reportedUBUNTU-CVE-2024-0450Not reported
Ubuntupython3.11debpro3.11.0~rc1-1~22.04.1~esm1Not reportedUBUNTU-CVE-2024-0450Not reported
Opensusepythonrpmtumbleweed2.7.18-47.1Not reportedOPENSUSE-SU-2024:13983-1Not reported
Susepython3rpmlinux enterprise module for web and scripting 123.4.10-25.130.1Not reportedSUSE-SU-2024:1843-1Not reported
Susepython3-baserpmlinux enterprise module for web and scripting 123.4.10-25.130.1Not reportedSUSE-SU-2024:1843-1Not reported
Susepython3rpmlinux enterprise software development kit 12 sp53.4.10-25.130.1Not reportedSUSE-SU-2024:1843-1Not reported
Susepython3-baserpmlinux enterprise software development kit 12 sp53.4.10-25.130.1Not reportedSUSE-SU-2024:1843-1Not reported
Susepython3rpmlinux enterprise server 12 sp53.4.10-25.130.1Not reportedSUSE-SU-2024:1843-1Not reported
Susepython3-baserpmlinux enterprise server 12 sp53.4.10-25.130.1Not reportedSUSE-SU-2024:1843-1Not reported
Susepython3rpmlinux enterprise server for sap applications 12 sp53.4.10-25.130.1Not reportedSUSE-SU-2024:1843-1Not reported
Susepython3-baserpmlinux enterprise server for sap applications 12 sp53.4.10-25.130.1Not reportedSUSE-SU-2024:1843-1Not reported
Susepythonrpmlinux enterprise server 12 sp52.7.18-33.35.1Not reportedSUSE-SU-2024:1844-1Not reported
Susepython-baserpmlinux enterprise server 12 sp52.7.18-33.35.1Not reportedSUSE-SU-2024:1844-1Not reported
Susepython-docrpmlinux enterprise server 12 sp52.7.18-33.35.1Not reportedSUSE-SU-2024:1844-1Not reported
Susepythonrpmlinux enterprise server for sap applications 12 sp52.7.18-33.35.1Not reportedSUSE-SU-2024:1844-1Not reported
Susepython-baserpmlinux enterprise server for sap applications 12 sp52.7.18-33.35.1Not reportedSUSE-SU-2024:1844-1Not reported
Susepython-docrpmlinux enterprise server for sap applications 12 sp52.7.18-33.35.1Not reportedSUSE-SU-2024:1844-1Not reported
Susepython-baserpmlinux enterprise workstation extension 12 sp52.7.18-33.35.1Not reportedSUSE-SU-2024:1844-1Not reported
Opensusepython311rpmtumbleweed3.11.8-5.1Not reportedOPENSUSE-SU-2024:13794-1Not reported

[Debian bug #1070133]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References