Skip to content

[security] zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size #83522

Closed
Closed
[security] zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size#83522
Labels
3.7 (EOL)end of life3.8 (EOL)end of life3.9 (EOL)end of lifestdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

Description

@vstinner
vstinner
opened on Jan 15, 2020
BPO 39341
Nosy @vstinner, @tiran, @serhiy-storchaka, @tirkarthi, @ret2libc
Superseder
  • bpo-36260: [security] CVE-2019-9674: Zip Bomb vulnerability
    		•
    Files
  • create_zip.py
  • poc.py
  • malicious.zip
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2020-02-10.07:59:22.985>
created_at = <Date 2020-01-15.09:57:18.176>
labels = ['type-security', '3.8', '3.7', 'library', '3.9']
title = "[security] zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size"
updated_at = <Date 2020-02-10.07:59:22.984>
user = 'https://github.com/vstinner'

    bugs.python.org fields:

    activity = <Date 2020-02-10.07:59:22.984>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2020-02-10.07:59:22.985>
closer = 'vstinner'
components = ['Library (Lib)']
creation = <Date 2020-01-15.09:57:18.176>
creator = 'vstinner'
dependencies = []
files = ['48843', '48844', '48845']
hgrepos = []
issue_num = 39341
keywords = []
message_count = 7.0
messages = ['360034', '360036', '360037', '360038', '360045', '360053', '361672']
nosy_count = 5.0
nosy_names = ['vstinner', 'christian.heimes', 'serhiy.storchaka', 'xtreak', 'rschiron']
pr_nums = []
priority = 'normal'
resolution = 'duplicate'
stage = 'resolved'
status = 'closed'
superseder = '36260'
type = 'security'
url = 'https://bugs.python.org/issue39341'
versions = ['Python 2.7', 'Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9']

    Activity

    1. vstinner commented on Jan 15, 2020

      @vstinner
      vstinner
      on Jan 15, 2020
      MemberAuthor

      Laish, Amit (GE Digital) reported a vulnerability in the zipfile module to the PSRT list. The module is vulnerable to ZIP Bomb:
      https://en.wikipedia.org/wiki/Zip_bomb

      A 100 KB malicious ZIP file announces an uncompressed size of 1 byte but extracting it writes 100 MB on disk.

      Python 2.7 is vulnerable.

      Python 3.7 does not seem to be directly vulnerable. The proof of concept fails with:

      $ python3 poc.py 
The size of the uncompressed data is: 1 bytes
Traceback (most recent call last):
  File "poc.py", line 18, in <module>
    extract() # The uncompressed size is more than 20GB :)
  File "poc.py", line 6, in extract
    zip_ref.extractall('./')
  File "/usr/lib64/python3.7/zipfile.py", line 1636, in extractall
    self._extract_member(zipinfo, path, pwd)
  File "/usr/lib64/python3.7/zipfile.py", line 1691, in _extract_member
    shutil.copyfileobj(source, target)
  File "/usr/lib64/python3.7/shutil.py", line 79, in copyfileobj
    buf = fsrc.read(length)
  File "/usr/lib64/python3.7/zipfile.py", line 930, in read
    data = self._read1(n)
  File "/usr/lib64/python3.7/zipfile.py", line 1020, in _read1
    self._update_crc(data)
  File "/usr/lib64/python3.7/zipfile.py", line 948, in _update_crc
    raise BadZipFile("Bad CRC-32 for file %r" % self.name)
zipfile.BadZipFile: Bad CRC-32 for file 'dummy1.txt'

      The malicious ZIP file size is 100 KB. Extracting it writes dummy1.txt: 100 MB only made of a single character "0" (zero, Unicode character U+0030 or byte 0x30) repeated on 100 MB.

      The original proof of concept used a 20 MB ZIP writing 20 GB on disk. It's just the same text file repeated 200 files. I created a smaller ZIP just to be able to upload it to bugs.python.org.

      Attached files:

      • create_zip.py: created malicious.zip from valid.zip: modify the uncompressed size of compressed dummy1.txt
      • valid.zip: compressed dummy1.txt, file size is 100 KB
      • poc.py: extract malicious.zip

      --

      The zipfile documentation describes "Decompression pitfalls":
      https://docs.python.org/dev/library/zipfile.html#decompression-pitfalls

      The zlib.decompress() function has a max_length parameter:
      https://docs.python.org/dev/library/zlib.html#zlib.Decompress.decompress

      See also my notes on "Archives and Zip Bomb":
      https://python-security.readthedocs.io/security.html#archives-and-zip-bomb

      --

      unzip program of Fedora unzip-6.0-44.fc31.x86_64 package has the same vulnerability:

      $ unzip malicious.zip 
Archive:  malicious.zip
  inflating: dummy1.txt 

$ unzip -l malicious.zip 
Archive:  malicious.zip
  Length      Date    Time    Name
---------  ---------- -----   
          1  03-12-2019 14:10   dummy1.txt

      --------- -------
      1 1 file

      --

      According to Riccardo Schirone (Red Hat), p7zip, on the other hand, seems to use the minimum value between the header value and the file one, so it extracts only 1 byte and correctly complains about CRC failures.

    2. vstinner
      added
      3.7 (EOL)end of life
      3.8 (EOL)end of life
      3.9 (EOL)end of life
      stdlibStandard Library Python modules in the Lib/ directory
      type-securityA security issue
      on Jan 15, 2020
    3. vstinner
      changed the title [-]zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size[/-] [+][security] zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size[/+] on Jan 15, 2020
    4. vstinner
      changed the title [-]zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size[/-] [+][security] zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size[/+] on Jan 15, 2020

    5. vstinner commented on Jan 15, 2020

      @vstinner
      vstinner
      on Jan 15, 2020
      MemberAuthor

      Amit Laish reported the exact same vulnerability to rubyzip and they released a fix for it, CVE-2019-16892.

    6. vstinner commented on Jan 15, 2020

      @vstinner
      vstinner
      on Jan 15, 2020
      MemberAuthor

      Is this issue a duplicate of bpo-36260 "[security] CVE-2019-9674: Zip Bomb vulnerability" which has been closed by documenting the issue (without touching zipfile.py)?

      The zipfile documentation now contains an explicit warning against ZIP bombs:

      """
      Resources limitations

      The lack of memory or disk volume would lead to decompression failed. For example, decompression bombs (aka ZIP bomb) apply to zipfile library that can cause disk volume exhaustion.
      """

      https://docs.python.org/dev/library/zipfile.html#resources-limitations

      Note: bpo-36462 "CVE-2019-9674 : zip bomb vulnerability in Lib/zipfile.py" was closed as duplicate of bpo-36260.

    7. tirkarthi commented on Jan 15, 2020

      @tirkarthi
      tirkarthi
      on Jan 15, 2020
      Member

      See also some discussion on regarding this class of vulnerability : https://bugs.python.org/issue36260

    8. serhiy-storchaka commented on Jan 15, 2020

      @serhiy-storchaka
      serhiy-storchaka
      on Jan 15, 2020
      Member

      Is this 2.7 only issue? I think it is too late.

    9. vstinner commented on Jan 15, 2020

      @vstinner
      vstinner
      on Jan 15, 2020
      MemberAuthor

      Is this 2.7 only issue? I think it is too late.

      I vaguely recall that Christian Heimes wrote something about Python 3 in a private email, but I cannot find this email anymore :-p In case of doubt, I marked Python 3 as affected as well.

    10. vstinner commented on Feb 10, 2020

      @vstinner
      vstinner
      on Feb 10, 2020
      MemberAuthor

      I close this issue as a duplicate of bpo-36260.

    11. vstinner
      closed this as completedon Feb 10, 2020
    12. vstinner
      closed this as completedon Feb 10, 2020
    13. ezio-melotti
      transferred this issue fromon Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      3.7 (EOL)end of life3.8 (EOL)end of life3.9 (EOL)end of lifestdlibStandard Library Python modules in the Lib/ directorytype-securityA security issue

      Projects

      No projects

        Milestone

        No milestone

        Relationships

        None yet

        Development

        No branches or pull requests

        Issue actions