Skip to content

CVE-2019-9674 : zip bomb vulnerability in Lib/zipfile.py #80643

Closed
Closed
CVE-2019-9674 : zip bomb vulnerability in Lib/zipfile.py#80643
Labels
3.7 (EOL)end of life3.8 (EOL)end of lifestdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@krnick
krnick
mannequin
opened on Mar 28, 2019
BPO 36462
Nosy @Yhg1s, @brettcannon, @serhiy-storchaka, @tirkarthi, @krnick
Superseder
  • bpo-36260: [security] CVE-2019-9674: Zip Bomb vulnerability
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2019-03-28.16:43:08.889>
created_at = <Date 2019-03-28.15:46:10.987>
labels = ['type-security', '3.8', '3.7', 'library']
title = 'CVE-2019-9674 : zip bomb vulnerability in Lib/zipfile.py'
updated_at = <Date 2019-03-29.00:03:09.020>
user = 'https://github.com/krnick'

    bugs.python.org fields:

    activity = <Date 2019-03-29.00:03:09.020>
actor = 'krnick'
assignee = 'none'
closed = True
closed_date = <Date 2019-03-28.16:43:08.889>
closer = 'brett.cannon'
components = ['Library (Lib)']
creation = <Date 2019-03-28.15:46:10.987>
creator = 'krnick'
dependencies = []
files = []
hgrepos = []
issue_num = 36462
keywords = []
message_count = 7.0
messages = ['339053', '339055', '339056', '339058', '339060', '339063', '339085']
nosy_count = 5.0
nosy_names = ['twouters', 'brett.cannon', 'serhiy.storchaka', 'xtreak', 'krnick']
pr_nums = []
priority = 'normal'
resolution = 'duplicate'
stage = 'resolved'
status = 'closed'
superseder = '36260'
type = 'security'
url = 'https://bugs.python.org/issue36462'
versions = ['Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8']

    Activity

    1. krnick commented on Mar 28, 2019

      @krnick
      krnickmannequin
      on Mar 28, 2019
      MannequinAuthor

      Dear Python Community,

      we found a python module vulnerability during these days and we got a CVE number, CVE-2019-9674 after reported it to cve.mitre.org.

      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9674

      The reserved information of CVE-2019-9674 is shown below:

         [Description]

       [Lib/zipfile.py](https://github.com/python/cpython/blob/main/Lib/zipfile.py) in Python through 3.7.2 allows remote 
       attackers to cause a denial of service (resource consumption) 
       via a ZIP bomb.


       [Additional Information]

       The python zipfile library version 3.2, 3.3, 3.4, 3.5, 3.6, 
       3.7, 3.8. Allow attackers to cause a denial of service (disk 
       volume exhaustion) via a ZIP bomb.


       We have found python standard library zipfile doesn't have 
       ZIP bomb detection and protection. If the user uses zipfile 
       library to unzip a ZIP bomb file, this might cause a denial 
       of service of the localhost.


      [VulnerabilityType Other]

      Denial-of-Service

      Our proposed solutions:

      1.The compression ratio:

Compression ratio = Uncompressed file size / Compressed file size

Since ZIP bomb file has a higher compression ratio (1028) than 
normal ZIP file (1 to 3). Therefore, we calculate the compression 
ratio and set a threshold for the detection.

2.Nested zip file

There is a high chance that it is zip bomb if it is a nested zip 
file. 

3.By limiting resources such as CPU, memory, disk usage.

      Unsolved issue

      However, we have not yet determined the compression ratio. We 
temporarily set the compression ratio to 10, and if it exceeds, it 
may be a ZIP bomb.

It is likely that detection may misjudge nested compressed files. 
For example, under normal circumstances, compressed files are 
included in the zip file.

      Our solution code：

      """For ratio"""

      def _exam_ratio(self, threshold=10):
    """If the ratio exceeds threshold, it may be a ZIP Bomb."""
    sum_file_size = sum([data.file_size for data in self.filelist])
    sum_compress_size = sum([data.compress_size for data in self.filelist])
    ratio = sum_file_size / sum_compress_size
    if (ratio > threshold):
        raise BadZipFile("Zip Bomb Detected")

      """For Nested zip file"""

      if(members.filename.endswith(".zip")):
      raise BadZipFile("Nested Zip File Detected")

      Thanks!

    2. krnick
      added
      3.7 (EOL)end of life
      3.8 (EOL)end of life
      stdlibStandard Library Python modules in the Lib/ directory
      type-securityA security issue
      on Mar 28, 2019

    3. serhiy-storchaka commented on Mar 28, 2019

      @serhiy-storchaka
      serhiy-storchaka
      on Mar 28, 2019
      Member

      I do not think that the library should limit the compression ratio. Large compression ratio is legit. For example, compressed file of size 1 GiB consisting of zeros has the compress ratio 1030 (and I suppose it is even larger if use bzip2 or lzma compressions).

      If this is a problem for your program, your program should make a decision what ZIP files should be rejected.

      I suggest to close this issue as "not a bug".

    4. tirkarthi commented on Mar 28, 2019

      @tirkarthi
      tirkarthi
      on Mar 28, 2019
      Member

      Going by CVE number and report is this a duplicate of bpo-36260 ?

    5. brettcannon commented on Mar 28, 2019

      @brettcannon
      brettcannon
      on Mar 28, 2019
      Member

      Closing as a duplicate of bpo-36260.

    6. brettcannon
      closed this as completedon Mar 28, 2019

    7. tirkarthi commented on Mar 28, 2019

      @tirkarthi
      tirkarthi
      on Mar 28, 2019
      Member

      I would request closing the other one as duplicate and opening this since this contains the actual report or perhaps the report could be copied to bpo-36260. Since Serhiy suggested closing this as not a bug I will leave it to him on resolution of the other issue too.

    8. brettcannon commented on Mar 28, 2019

      @brettcannon
      brettcannon
      on Mar 28, 2019
      Member

      You can also leave a comment in the other issue saying there's more details
      in the closed duplicate.

      On Thu, Mar 28, 2019 at 9:54 AM Karthikeyan Singaravelan <
      report@bugs.python.org> wrote:

      Karthikeyan Singaravelan <tir.karthi@gmail.com> added the comment:

      I would request closing the other one as duplicate and opening this since
      this contains the actual report or perhaps the report could be copied to
      bpo-36260. Since Serhiy suggested closing this as not a bug I will leave
      it to him on resolution of the other issue too.

      ----------

      Python tracker <report@bugs.python.org>
      <https://bugs.python.org/issue36462\>

    9. krnick commented on Mar 29, 2019

      @krnick
      krnickmannequin
      on Mar 29, 2019
      MannequinAuthor

      Thanks to the python community, both of these issues are the same.

      I also think it's a good thing to make related documentation to reduce this type of problem rather than implementing it on a low-level zipfile module. Perhaps we can customize such a requirement through a pip package.

    10. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      3.7 (EOL)end of life3.8 (EOL)end of lifestdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions