7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-8088

CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython "zipfile" module. When...

There is a HIGH severity vulnerability affecting the CPython "zipfile" module.

When iterating over names of entries in a zip archive (for example, methods of "zipfile.ZipFile" like "namelist()", "iterdir()", "extractall()", etc) the process can be put into an infinite loop with a maliciously crafted zip archive. This defect applies when reading only metadata or extracting the contents of the zip archive. Programs that are not handling user-controlled zip archives are not affected.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-8088

CVE-2024-8088:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2024-8088) causes an infinite loop when processing maliciously crafted zip archives due to malformed entry names, particularly those with repeating slashes. The core issue was identified in the _ancestry function (present in both Lib/zipfile/_path/__init__.py and Lib/zipfile.py across different versions/contexts). The original loop condition in _ancestry (while path and path != posixpath.sep:) did not correctly handle paths where posixpath.split failed to reduce the path string, leading to an infinite loop. Commits like 2231286d78d328c2f575e0b05b16fe447d1656d6 and 7bc367e464ce50b956dd232c1dfa1cad4e7fb814 fixed this by changing the loop condition to while path.rstrip(posixpath.sep):, ensuring progress. Functions like zipfile.Path.iterdir, zipfile.ZipFile.namelist, and zipfile.ZipFile.extractall are listed as vulnerable because they either directly or indirectly use this path processing logic or handle the malformed names that trigger the vulnerability, and they are explicitly mentioned in the vulnerability description as affected methods. The initial patches involving SanitizedNames._sanitize also highlight that name processing is central to the vulnerability, even though this specific mitigation was later refined to a more direct fix in _ancestry.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.