6.2

CVSS Score

3.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-5569

CVE-2024-5569: zipp Denial of Service vulnerability

A Denial of Service (DoS) vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the third-party zipp library are later merged into CPython, and the affected code is identical in both projects. The infinite loop can be initiated through the use of functions affecting the Path module in both zipp and zipfile, such as joinpath, the overloaded division operator, and iterdir. Although the infinite loop is not resource exhaustive, it prevents the application from responding. The vulnerability was addressed in version 3.19.1 of jaraco/zipp.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-5569

CVE-2024-5569:

6.2

CVSS Score

3.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
zipp	pip	< 3.19.1	3.19.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly states that an infinite loop in zipp can be triggered via Path.joinpath, the overloaded division operator (Path.__truediv__), and Path.iterdir. These methods are part of the zipp.Path class defined in zipp/__init__.py and operate on path names within the zip archive. The provided commit fd604bd34f0343472521a36da1fbd22e793e14fd addresses the vulnerability by introducing a SanitizedNames mixin for the CompleteDirs class. This mixin overrides the namelist() method to sanitize path names using a new _sanitize method, which cleans paths by removing redundant slashes and resolving . and .. components (e.g., '//foo.txt' becomes 'foo.txt', 'foo/.././bar.txt' becomes 'foo/bar.txt'). This indicates that prior to the patch, the namelist() method (used by zipp.Path methods to get file/directory names) returned unsanitized names. When zipp.Path.iterdir, zipp.Path.joinpath, and zipp.Path.__truediv__ consumed these unsanitized, malformed names, their internal path resolution or iteration logic could enter an infinite loop. The patch prevents this by ensuring these Path methods receive sanitized names. Therefore, these three methods are identified as the vulnerable functions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.