CVE catalog

CVE-2024-8088

Python vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.27% · Oct 25, 2026

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive (for example, methods of "zipfile.Path" like "namelist()", "iterdir()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpypy3sid8.0.1+dfsg-1fixed
Debianpypy3forky8.0.1+dfsg-1fixed
Debianpypy3trixie7.3.19+dfsg-2fixed
Debianpypy3bookworm7.3.11+dfsg-2+deb12u3vulnerable
Debianpython3.11bookworm3.11.2-6+deb12u8fixed
Debianpython3.11bookworm-security3.11.2-6+deb12u9fixed
Ubuntupypy3nobleNot reportedvulnerable
Ubuntupython3.11noble3.11.2-6+deb12u3fixed
Ubuntupython3.12noble3.12.3-1ubuntu0.2fixed
Ubuntuidle-python3.12noble3.12.3-1ubuntu0.2fixed
Ubuntulibpython3.12-devnoble3.12.3-1ubuntu0.2fixed
Ubuntulibpython3.12-minimalnoble3.12.3-1ubuntu0.2fixed
Ubuntulibpython3.12-stdlibnoble3.12.3-1ubuntu0.2fixed
Ubuntulibpython3.12-testsuitenoble3.12.3-1ubuntu0.2fixed
Ubuntulibpython3.12t64noble3.12.3-1ubuntu0.2fixed
Ubuntupython3.12-devnoble3.12.3-1ubuntu0.2fixed
Ubuntupython3.12-docnoble3.12.3-1ubuntu0.2fixed
Ubuntupython3.12-examplesnoble3.12.3-1ubuntu0.2fixed
Ubuntupython3.12-fullnoble3.12.3-1ubuntu0.2fixed
Ubuntupython3.12-minimalnoble3.12.3-1ubuntu0.2fixed
Ubuntupython3.12-nopienoble3.12.3-1ubuntu0.2fixed
Ubuntupython3.12-venvnoble3.12.3-1ubuntu0.2fixed
Alpinepython33.173.10.14-r2fixed
Alpinepython33.183.11.8-r1fixed
Alpinepython33.193.11.9-r1fixed
Alpinepython33.203.12.3-r2fixed
Alpinepython33.213.12.5-r1fixed
Alpinepython33.223.12.5-r1fixed
Alpinepython33.233.12.5-r1fixed
Alpinepython33.243.12.5-r1fixed
Ubuntupython3.8pro3.8.0-3~18.04vulnerable
Ubuntupython3.8pro3.8.0-3~18.04.1vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm1vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm2vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm3vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm4vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm5vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm6vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm7vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm8vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm9vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm10vulnerable
Ubuntupython3.8pro3.8.0-3ubuntu1~18.04.2+esm11vulnerable
Ubuntupython3.820.043.8.0-1vulnerable
Ubuntupython3.820.043.8.0-2vulnerable
Ubuntupython3.820.043.8.0-3vulnerable
Ubuntupython3.820.043.8.0-4vulnerable
Ubuntupython3.820.043.8.0-5vulnerable
Ubuntupython3.820.043.8.1-2ubuntu3vulnerable
Ubuntupython3.820.043.8.2~rc1-1ubuntu1vulnerable
Ubuntupython3.820.043.8.2-1vulnerable
Ubuntupython3.820.043.8.2-1ubuntu1vulnerable
Ubuntupython3.820.043.8.2-1ubuntu1.1vulnerable
Ubuntupython3.820.043.8.2-1ubuntu1.2vulnerable
Ubuntupython3.820.043.8.5-1~20.04vulnerable
Ubuntupython3.820.043.8.5-1~20.04.2vulnerable
Ubuntupython3.820.043.8.5-1~20.04.3vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.1vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.2vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.4vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.5vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.6vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.7vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.8vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.9vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.10vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.11vulnerable
Ubuntupython3.820.043.8.10-0ubuntu1~20.04.12fixed
Ubuntupython3.9pro3.9.0~rc1-1~20.04vulnerable
Ubuntupython3.9pro3.9.0-5~20.04vulnerable
Ubuntupython3.9pro3.9.5-3~20.04.1vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm1vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm2vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm3vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm4vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm5vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm6vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm7vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm8vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm9vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm10vulnerable
Ubuntupython3.9pro3.9.5-3ubuntu0~20.04.1+esm11vulnerable
Ubuntupython3.1022.043.10.0-2vulnerable
Ubuntupython3.1022.043.10.0-3vulnerable
Ubuntupython3.1022.043.10.0-4vulnerable
Ubuntupython3.1022.043.10.0-5vulnerable
Ubuntupython3.1022.043.10.0-5build1vulnerable
Ubuntupython3.1022.043.10.1-1vulnerable
Ubuntupython3.1022.043.10.1-2vulnerable
Ubuntupython3.1022.043.10.2-1vulnerable
Ubuntupython3.1022.043.10.2-5vulnerable
Ubuntupython3.1022.043.10.2-7vulnerable
Ubuntupython3.1022.043.10.3-1vulnerable
Ubuntupython3.1022.043.10.4-3vulnerable
Ubuntupython3.1022.043.10.4-3ubuntu0.1vulnerable
Ubuntupython3.1022.043.10.6-1~22.04vulnerable
Ubuntupython3.1022.043.10.6-1~22.04.1vulnerable
Ubuntupython3.1022.043.10.6-1~22.04.2vulnerable
Ubuntupython3.1022.043.10.6-1~22.04.2ubuntu1vulnerable
Ubuntupython3.1022.043.10.6-1~22.04.2ubuntu1.1vulnerable
Ubuntupython3.1022.043.10.12-1~22.04.2vulnerable
Ubuntupython3.1022.043.10.12-1~22.04.3vulnerable
Ubuntupython3.1022.043.10.12-1~22.04.4vulnerable
Ubuntupython3.1022.043.10.12-1~22.04.5vulnerable
Ubuntupython3.1022.043.10.12-1~22.04.6fixed
Ubuntupython3.11pro3.11.0~rc1-1~22.04vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1~esm1vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1~esm2vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1~esm3vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1~esm4vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1~esm5vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1~esm6vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1~esm7vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1~esm8vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1~esm9vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1+esm1vulnerable
Ubuntupython3.11pro3.11.0~rc1-1~22.04.1+esm2vulnerable
Ubuntupython3.1224.043.12.0-1vulnerable
Ubuntupython3.1224.043.12.0-5vulnerable
Ubuntupython3.1224.043.12.0-6vulnerable
Ubuntupython3.1224.043.12.0-7vulnerable
Ubuntupython3.1224.043.12.1-2vulnerable
Ubuntupython3.1224.043.12.2-1vulnerable
Ubuntupython3.1224.043.12.2-4build3vulnerable
Ubuntupython3.1224.043.12.2-4build4vulnerable
Ubuntupython3.1224.043.12.2-5ubuntu3vulnerable
Ubuntupython3.1224.043.12.3-1vulnerable
Ubuntupython3.1224.043.12.3-1ubuntu0.1vulnerable
Ubuntupython3.1224.043.12.3-1ubuntu0.2fixed
Opensusepython310tumbleweed3.10.14-7.1fixed
Opensusepython311tumbleweed3.11.9-7.1fixed
Opensusepython313tumbleweed3.13.0~rc1-3.1fixed
Opensusepython38tumbleweed3.8.19-8.1fixed
Opensusepython312tumbleweed3.12.5-2.1fixed
Opensusepython39tumbleweed3.9.19-7.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpypy3sourcesid7.3.18+dfsg-1not yet assignedNot reportedNot reported
Debianpypy3sourceforky7.3.18+dfsg-1not yet assignedNot reportedNot reported
Debianpypy3sourcetrixie7.3.18+dfsg-1not yet assignedNot reportedNot reported
Debianpypy3sourcebookworm(unfixed)not yet assignedNot reportedNot reported
Debianpython3.11sourcebookworm3.11.2-6+deb12u3not yet assignedNot reportedNot reported
Ubuntupython3.11debnoble3.11.2-6+deb12u3Not reportedNot reportedNot reported
Ubuntupython3.12debnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntuidle-python3.12debnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibpython3.12-devdebnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibpython3.12-minimaldebnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibpython3.12-stdlibdebnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibpython3.12-testsuitedebnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntulibpython3.12t64debnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntupython3.12-devdebnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntupython3.12-docdebnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntupython3.12-examplesdebnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntupython3.12-fulldebnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntupython3.12-minimaldebnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntupython3.12-nopiedebnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Ubuntupython3.12-venvdebnoble3.12.3-1ubuntu0.2Not reportedNot reportedNot reported
Alpinepython3apk3.173.10.14-r2Not reportedALPINE-CVE-2024-8088Not reported
Alpinepython3apk3.183.11.8-r1Not reportedALPINE-CVE-2024-8088Not reported
Alpinepython3apk3.193.11.9-r1Not reportedALPINE-CVE-2024-8088Not reported
Alpinepython3apk3.203.12.3-r2Not reportedALPINE-CVE-2024-8088Not reported
Alpinepython3apk3.213.12.5-r1Not reportedALPINE-CVE-2024-8088Not reported
Alpinepython3apk3.223.12.5-r1Not reportedALPINE-CVE-2024-8088Not reported
Alpinepython3apk3.233.12.5-r1Not reportedALPINE-CVE-2024-8088Not reported
Alpinepython3apk3.243.12.5-r1Not reportedALPINE-CVE-2024-8088Not reported
Ubuntupython3.8deb20.043.8.10-0ubuntu1~20.04.12Not reportedUBUNTU-CVE-2024-8088Not reported
Ubuntupython3.10deb22.043.10.12-1~22.04.6Not reportedUBUNTU-CVE-2024-8088Not reported
Ubuntupython3.12deb24.043.12.3-1ubuntu0.2Not reportedUBUNTU-CVE-2024-8088Not reported
Opensusepython310rpmtumbleweed3.10.14-7.1Not reportedOPENSUSE-SU-2024:14298-1Not reported
Opensusepython311rpmtumbleweed3.11.9-7.1Not reportedOPENSUSE-SU-2024:14299-1Not reported
Opensusepython313rpmtumbleweed3.13.0~rc1-3.1Not reportedOPENSUSE-SU-2024:14301-1Not reported
Opensusepython38rpmtumbleweed3.8.19-8.1Not reportedOPENSUSE-SU-2024:14296-1Not reported
Opensusepython312rpmtumbleweed3.12.5-2.1Not reportedOPENSUSE-SU-2024:14300-1Not reported
Opensusepython39rpmtumbleweed3.9.19-7.1Not reportedOPENSUSE-SU-2024:14297-1Not reported

Notes

[bookworm] pypy3: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [pypy3]Affected
    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

    • 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

  • [pypy3-dev]Affected

    Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

  • [pypy3-doc]Affected

    Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

  • [pypy3-lib]Affected

    Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

    • 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

  • Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

  • [pypy3-tk]Affected

    Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · amd64 · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

    • 7.3.11+dfsg-2+deb12u3 · arm64 · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

  • [pypy3-venv]Affected

    Source package: [pypy3]

    Details (2)
    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

    • 7.3.11+dfsg-2+deb12u3 · all · bookworm

      Affected

      usn · pypy3 · debian · bookworm; usn · pypy3 · debian · 12

[openSUSE Tumbleweed]

  • Source package: [python310]

    Details (1)
    • 3.10.20-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.10.14-7.1

      Version impact unknown

      usn · python310 · opensuse · tumbleweed

  • [python310-dbm]Unknown

    Source package: [python310]

    Details (1)
    • 3.10.20-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.10.14-7.1

      Version impact unknown

      usn · python310 · opensuse · tumbleweed

  • Source package: [python310]

    Details (1)
    • 3.10.20-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.10.14-7.1

      Version impact unknown

      usn · python310 · opensuse · tumbleweed

  • [python310-tk]Unknown

    Source package: [python310]

    Details (1)
    • 3.10.20-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.10.14-7.1

      Version impact unknown

      usn · python310 · opensuse · tumbleweed

  • Source package: [python311]

    Details (1)
    • 3.11.15-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.11.9-7.1

      Version impact unknown

      usn · python311 · opensuse · tumbleweed

  • Source package: [python311]

    Details (1)
    • 3.11.15-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.11.9-7.1

      Version impact unknown

      usn · python311 · opensuse · tumbleweed

  • [python311-dbm]Unknown

    Source package: [python311]

    Details (1)
    • 3.11.15-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.11.9-7.1

      Version impact unknown

      usn · python311 · opensuse · tumbleweed

  • Source package: [python311]

    Details (1)
    • 3.11.15-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.11.9-7.1

      Version impact unknown

      usn · python311 · opensuse · tumbleweed

  • [python311-tk]Unknown

    Source package: [python311]

    Details (1)
    • 3.11.15-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.11.9-7.1

      Version impact unknown

      usn · python311 · opensuse · tumbleweed

  • Source package: [python311]

    Details (1)
    • 3.11.15-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.11.9-7.1

      Version impact unknown

      usn · python311 · opensuse · tumbleweed

  • Source package: [python312]

    Details (1)
    • 3.12.13-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.12.5-2.1

      Version impact unknown

      usn · python312 · opensuse · tumbleweed

  • Source package: [python312]

    Details (1)
    • 3.12.13-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.12.5-2.1

      Version impact unknown

      usn · python312 · opensuse · tumbleweed

  • [python312-dbm]Unknown

    Source package: [python312]

    Details (1)
    • 3.12.13-9.1 · x86_64 · tumbleweed

      Unknown · Fixed: 3.12.5-2.1

      Version impact unknown

      usn · python312 · opensuse · tumbleweed

Next results

Observed:

References