Repository navigation
[security] zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size #83522
Description
| BPO | 39341 |
|---|---|
| Nosy | @vstinner, @tiran, @serhiy-storchaka, @tirkarthi, @ret2libc |
| Superseder | |
| Files |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = None
closed_at = <Date 2020-02-10.07:59:22.985>
created_at = <Date 2020-01-15.09:57:18.176>
labels = ['type-security', '3.8', '3.7', 'library', '3.9']
title = "[security] zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size"
updated_at = <Date 2020-02-10.07:59:22.984>
user = 'https://github.com/vstinner'bugs.python.org fields:
activity = <Date 2020-02-10.07:59:22.984>
actor = 'vstinner'
assignee = 'none'
closed = True
closed_date = <Date 2020-02-10.07:59:22.985>
closer = 'vstinner'
components = ['Library (Lib)']
creation = <Date 2020-01-15.09:57:18.176>
creator = 'vstinner'
dependencies = []
files = ['48843', '48844', '48845']
hgrepos = []
issue_num = 39341
keywords = []
message_count = 7.0
messages = ['360034', '360036', '360037', '360038', '360045', '360053', '361672']
nosy_count = 5.0
nosy_names = ['vstinner', 'christian.heimes', 'serhiy.storchaka', 'xtreak', 'rschiron']
pr_nums = []
priority = 'normal'
resolution = 'duplicate'
stage = 'resolved'
status = 'closed'
superseder = '36260'
type = 'security'
url = 'https://bugs.python.org/issue39341'
versions = ['Python 2.7', 'Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9']
Activity
vstinner commentedon Jan 15, 2020
Laish, Amit (GE Digital) reported a vulnerability in the zipfile module to the PSRT list. The module is vulnerable to ZIP Bomb:
https://en.wikipedia.org/wiki/Zip_bomb
A 100 KB malicious ZIP file announces an uncompressed size of 1 byte but extracting it writes 100 MB on disk.
Python 2.7 is vulnerable.
Python 3.7 does not seem to be directly vulnerable. The proof of concept fails with:
The malicious ZIP file size is 100 KB. Extracting it writes dummy1.txt: 100 MB only made of a single character "0" (zero, Unicode character U+0030 or byte 0x30) repeated on 100 MB.
The original proof of concept used a 20 MB ZIP writing 20 GB on disk. It's just the same text file repeated 200 files. I created a smaller ZIP just to be able to upload it to bugs.python.org.
Attached files:
--
The zipfile documentation describes "Decompression pitfalls":
https://docs.python.org/dev/library/zipfile.html#decompression-pitfalls
The zlib.decompress() function has a max_length parameter:
https://docs.python.org/dev/library/zlib.html#zlib.Decompress.decompress
See also my notes on "Archives and Zip Bomb":
https://python-security.readthedocs.io/security.html#archives-and-zip-bomb
--
unzip program of Fedora unzip-6.0-44.fc31.x86_64 package has the same vulnerability:
--------- -------
1 1 file
--
According to Riccardo Schirone (Red Hat), p7zip, on the other hand, seems to use the minimum value between the header value and the file one, so it extracts only 1 byte and correctly complains about CRC failures.
[-]zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size[/-][+][security] zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size[/+][-]zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size[/-][+][security] zipfile: ZIP Bomb vulnerability, don't check announced uncompressed size[/+]vstinner commentedon Jan 15, 2020
Amit Laish reported the exact same vulnerability to rubyzip and they released a fix for it, CVE-2019-16892.
vstinner commentedon Jan 15, 2020
Is this issue a duplicate of bpo-36260 "[security] CVE-2019-9674: Zip Bomb vulnerability" which has been closed by documenting the issue (without touching zipfile.py)?
The zipfile documentation now contains an explicit warning against ZIP bombs:
"""
Resources limitations
The lack of memory or disk volume would lead to decompression failed. For example, decompression bombs (aka ZIP bomb) apply to zipfile library that can cause disk volume exhaustion.
"""
https://docs.python.org/dev/library/zipfile.html#resources-limitations
Note: bpo-36462 "CVE-2019-9674 : zip bomb vulnerability in Lib/zipfile.py" was closed as duplicate of bpo-36260.
tirkarthi commentedon Jan 15, 2020
See also some discussion on regarding this class of vulnerability : https://bugs.python.org/issue36260
serhiy-storchaka commentedon Jan 15, 2020
Is this 2.7 only issue? I think it is too late.
vstinner commentedon Jan 15, 2020
I vaguely recall that Christian Heimes wrote something about Python 3 in a private email, but I cannot find this email anymore :-p In case of doubt, I marked Python 3 as affected as well.
vstinner commentedon Feb 10, 2020
I close this issue as a duplicate of bpo-36260.