Skip to content
Fencer Vulns
medium 6.2

CVE-2024-5569 json

Denial of Service via crafted zip file in jaraco/zipp

published 2024-07-09 2 y ago modified 2026-09-10 1 mo ago also GHSA-jfmj-5v4g-7637 , PYSEC-2026-2074 , EUVD-2024-2374

cvss
6.2
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits
0
none known

Summary

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the `Path` module in both zipp and zipfile, such as `joinpath`, the overloaded division operator, and `iterdir`. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

Patch / fix

  • pypi zipp 3.19.1
  • jaraco jaraco/zipp 3.19.1
  • python-zipp Debian 12 1.0.0-6+deb12u1
  • python-zipp Debian 13 3.19.2-1

debian advisories DEBIAN-CVE-2024-5569

  • python-zipp Ubuntu 20.04 LTS 1.0.0-1ubuntu0.1
  • python-zipp Ubuntu 22.04 LTS 1.0.0-3ubuntu0.1
  • python-zipp Ubuntu 24.04 LTS 1.0.0-6ubuntu0.1

ubuntu advisories UBUNTU-CVE-2024-5569

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-zipp openstack 17.1 3.4.0-3.el9ost
  • python3-zipp openstack 17.1 3.4.0-3.el9ost
  • cjson satellite capsule 6.16, satellite 6.16 1.7.17-1.el8sat
  • cjson satellite capsule 6.16, satellite 6.16 1.7.17-1.el9sat
  • foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.1-1.el8sat
  • foreman satellite utils 6.16, satellite capsule 6.16, satellite 6.16 3.12.0.1-1.el9sat
  • katello satellite capsule 6.16, satellite 6.16 4.14.0-0.1.rc2.el8sat
  • katello satellite capsule 6.16, satellite 6.16 4.14.0-0.1.rc2.el9sat

red hat advisories RHSA-2024:9977RHSA-2024:8906RHSA-2024:8418RHSA-2024:8232RHSA-2024:6428

  • venv-salt-minion Manager Client Tools for RHEL, Liberty and Clones 9-CLIENT-TOOLS, EL-9:Update:Products:SaltBundle:Update 3006.0-1.47.1
  • saltbundlepy EL-9:Update:Products:SaltBundle:Update 3.11.9-1.26.1
  • saltbundlepy-core EL-9:Update:Products:SaltBundle:Update 3.11.9-1.26.1
  • saltbundlepy-idna EL-9:Update:Products:SaltBundle:Update 3.4-1.9.2
  • saltbundlepy-zipp EL-9:Update:Products:SaltBundle:Update 3.15.0-1.9.2
  • saltbundlepy-docker EL-9:Update:Products:SaltBundle:Update 7.0.0-1.8.1
  • saltbundlepy-passlib EL-9:Update:Products:SaltBundle:Update 1.7.4-1.3.1
  • saltbundlepy-urllib3 EL-9:Update:Products:SaltBundle:Update 2.0.7-1.12.1

suse advisories SUSE-EL-9-CLIENT-TOOLS-2024-4029SUSE-SU-2024:4029-1SUSE-SU-2024:4021-1SUSE-SU-2024:4020-1SUSE-SU-2024:2400-1SUSE-SU-2024:2397-1

  • python-zipp openSUSE Tumbleweed 4.1.0-1.2
  • python-zipp openSUSE Tumbleweed 3.19.2-2.1

opensuse advisories openSUSE-SU-2026:12048-1openSUSE-SU-2024:14167-1

  • py3-zipp Alpine 3.22 3.17.0-r2
  • py3-zipp Alpine 3.24, Alpine 3.23 3.23.0-r0

alpine advisories ALPINE-CVE-2024-5569

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • tensorflow Azure Linux 3.0 2.16.1-9
  • python-zipp Azure Linux 3.0 3.17.0-3

azure linux advisories AZL-43189AZL-43198

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-5569 updated cvss 6.2

github.com/jaraco/zipp: Denial of Service (infinite loop) via crafted zip file in jaraco/zipp

  • Red Hat OpenStack Platform 16.2 python3-zipp
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 18.0 python-zipp
    affected: no fix available
  • Red Hat Update Infrastructure 4 for Cloud Providers python-zipp
    affected: no fix planned “Will not fix”
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.16 python-zipp 3.19.1-1.el9, python3-zipp 3.19.1-1.el9
    fixed: vendor fix RHSA-2024:8418
  • Red Hat Ironic content for Red Hat OpenShift Container Platform 4.17 python-zipp 3.19.1-1.el9, python3-zipp 3.19.1-1.el9
    fixed: vendor fix RHSA-2024:8232
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-zipp 3.19.2-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-zipp 3.19.2-1.el9ap, python3-zipp 3.19.2-1.el9ap
    fixed: vendor fix RHSA-2024:6428
  • Red Hat OpenStack Platform 17.1 python-zipp 3.4.0-3.el9ost, python3-zipp 3.4.0-3.el9ost
    fixed: vendor fix RHSA-2024:9977
  • Red Hat Satellite 6.16 for RHEL 8 python-zipp 3.20.2-1.el8pc, python3.11-zipp 3.20.2-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-zipp 3.20.2-1.el9pc, python3.11-zipp 3.20.2-1.el9pc
    fixed: vendor fix RHSA-2024:8906
show 1 more
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-django 4.2.15-1.el8ap, python39-grpcio 1.58.3-1.el8ap, python3x-django 4.2.15-1.el8ap, python3x-grpcio 1.58.3-1.el8ap, python39-gunicorn 22.0.0-2.el8ap, python39-jmespath 0.10.0-5.el8ap, +11 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-django 4.2.15-1.el9ap, python-grpcio 1.58.3-1.el9ap, python3-django 4.2.15-1.el9ap, python3-grpcio 1.58.3-1.el9ap, python-gunicorn 22.0.0-2.el9ap, python-jmespath 0.10.0-5.el9ap, +11 more Red Hat OpenShift Container Platform 4.16 perf 5.14.0-427.42.1.el9_4, rtla 5.14.0-427.42.1.el9_4, bpftool 7.3.0-427.42.1.el9_4, kernel 5.14.0-427.42.1.el9_4, kernel-rt 5.14.0-427.42.1.el9_4, kernel-64k 5.14.0-427.42.1.el9_4, +66 more Red Hat OpenShift Container Platform 4.17 cri-tools 1.30.0-5.el8, cri-tools 1.30.0-5.el9, runc 1.1.14-2.rhaos4.17.el9, podman 5.2.3-2.rhaos4.17.el8, podman 5.2.3-2.rhaos4.17.el9, butane 0.22.0-2.rhaos4.17.el8, +53 more Red Hat Satellite 6.16 for RHEL 8 cjson 1.7.17-1.el8sat, libcomps 0.1.21-1.el8pc, libsolv 0.7.20-6.el8sat, python-jq 1.6.0-3.el8pc, python-pbr 5.8.0-7.el8pc, candlepin 4.4.16-1.el8sat, +675 more Red Hat Satellite 6.16 for RHEL 9 cjson 1.7.17-1.el9sat, libcomps 0.1.21-1.el9pc, python-jq 1.6.0-3.el9pc, python-pbr 5.8.0-7.el9pc, candlepin 4.4.16-1.el9sat, foreman 3.12.0.1-1.el9sat, +645 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.0 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.0 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi zipp
<3.19.1
3.19.1

Affected products

  • jaraco jaraco/zipp

Classification

Weakness
  • CWE-835 Loop with Unreachable Exit Condition
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.