Input validation error in Python - CVE-2013-7338
Published: April 22, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU41776
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-7338
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Python before 3.3.4 RC1 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a file size value larger than the size of the zip file to the (1) ZipExtFile.read, (2) ZipExtFile.read(n), (3) ZipExtFile.readlines, (4) ZipFile.extract, or (5) ZipFile.extractall function.
Affected software
Python
Gentoo Linux
dev-lang/python
Gentoo Linux
dev-lang/python
How to mitigate CVE-2013-7338
Install update from vendor's website.
dev-lang/python - update to 3.3.5-r1
External References
- http://bugs.python.org/issue20078
- http://hg.python.org/cpython/rev/79ea4ce431b1
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00008.html
- http://seclists.org/oss-sec/2014/q1/592
- http://seclists.org/oss-sec/2014/q1/595
- http://www.securityfocus.com/bid/65179
- http://www.securitytracker.com/id/1029973
- https://docs.python.org/3.3/whatsnew/changelog.html
- https://security.gentoo.org/glsa/201503-10
- https://support.apple.com/kb/HT205031