CVE-2024-5569

Description

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

CVSS Metrics

• v4.0•MEDIUM•Score: 6.9CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• v3.1•MEDIUM•Score: 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• v3.0•MEDIUM•Score: 6.2CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.24%• Percentile: 15%

Techniques & Countermeasures

• CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

  The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Systems

• chainguard•checkov

  < 3.0.34-r1

• chainguard•kubeflow-pipelines

  < 2.2.0-r7

• chainguard•kubeflow-pipelines-apiserver

  < 2.2.0-r7

• chainguard•kubeflow-pipelines-cache_server

  < 2.2.0-r7

• chainguard•kubeflow-pipelines-cache-deployer

  < 2.2.0-r7

• chainguard•kubeflow-pipelines-cache-deployer-compat

  < 2.2.0-r7

• chainguard•kubeflow-pipelines-frontend

  < 2.2.0-r7

• chainguard•kubeflow-pipelines-metadata-envoy-config

  < 2.2.0-r7

• chainguard•kubeflow-pipelines-metadata-writer

  < 2.2.0-r7

• chainguard•kubeflow-pipelines-metadata-writer-compat

  < 2.2.0-r7

• chainguard•kubeflow-pipelines-persistence_agent

  < 2.2.0-r7

• chainguard•kubeflow-pipelines-scheduledworkflow

  < 2.2.0-r7

• chainguard•kubeflow-pipelines-viewer-crd-controller

  < 2.2.0-r7

• chainguard•py3-supported-zipp

  < 0

• chainguard•py3-zipp

  < 0

• chainguard•py3.10-zipp

  < 0

• chainguard•py3.11-zipp

  < 0

• chainguard•py3.12-zipp

  < 0

• chainguard•py3.13-zipp

  < 0

• chainguard•superset

  < 4.0.2-r2

• wolfi•checkov

  < 3.0.34-r1

• wolfi•kubeflow-pipelines

  < 2.2.0-r7

• wolfi•kubeflow-pipelines-apiserver

  < 2.2.0-r7

• wolfi•kubeflow-pipelines-cache_server

  < 2.2.0-r7

• wolfi•kubeflow-pipelines-cache-deployer

  < 2.2.0-r7

• wolfi•kubeflow-pipelines-cache-deployer-compat

  < 2.2.0-r7

• wolfi•kubeflow-pipelines-frontend

  < 2.2.0-r7

• wolfi•kubeflow-pipelines-metadata-envoy-config

  < 2.2.0-r7

• wolfi•kubeflow-pipelines-metadata-writer

  < 2.2.0-r7

• wolfi•kubeflow-pipelines-metadata-writer-compat

  < 2.2.0-r7

• wolfi•kubeflow-pipelines-persistence_agent

  < 2.2.0-r7

• wolfi•kubeflow-pipelines-scheduledworkflow

  < 2.2.0-r7

• wolfi•kubeflow-pipelines-viewer-crd-controller

  < 2.2.0-r7

• wolfi•py3-supported-zipp

  < 0

• wolfi•py3-zipp

  < 0

• wolfi•py3.10-zipp

  < 0

• wolfi•py3.11-zipp

  < 0

• wolfi•py3.12-zipp

  < 0

• wolfi•py3.13-zipp

  < 0

• wolfi•superset

  < 4.0.2-r2

• debian•python-zipp

  all | < 1.0.0-6+deb12u1 | < 3.19.2-1 | < 3.19.2-1

• jaraco•jaraco/zipp

  ≥ unspecified, < 3.19.1

• PyPI•zipp

  < 3.19.1

• redhat•python-zipp

  < 0:3.4.0-3.el9ost

• redhat•python3-zipp

  < 0:3.4.0-3.el9ost

References (14)

• https://huntr.com/bounties/be898306-11f9-46b4-b28c-f4c4aa4ffbae
• https://github.com/jaraco/zipp/commit/fd604bd34f0343472521a36da1fbd22e793e14fd
• https://nvd.nist.gov/vuln/detail/CVE-2024-5569
• https://github.com/jaraco/zipp
• https://pypi.org/project/zipp
• https://github.com/advisories/GHSA-jfmj-5v4g-7637
• https://access.redhat.com/errata/RHSA-2024:9977
• https://access.redhat.com/security/updates/classification/#moderate
• https://bugzilla.redhat.com/show_bug.cgi?id=2296413
• https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9977.json
• https://access.redhat.com/security/cve/CVE-2024-5569
• https://www.cve.org/CVERecord?id=CVE-2024-5569
• https://security-tracker.debian.org/tracker/CVE-2024-5569
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5569.json