SUSE · security update for python3.9
Affects SUSESource GCVE Database
Not known to be exploited · CVSS 8.7 High : upgrade the Red Hat redhat/python3.9 package to 9.5.0 soon.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 1.2% chance of exploitation in 30 days – higher than 69% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 9.5.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/S:N/AU:N/R:U/RE:LExploitation evidence
Disclosed: evidence found.
CVE published 22 Aug 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade the Red Hat redhat/python3.9 package to 9.5.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
Red Hatredhat/python3.9pkg:rpm/redhat/python3.9Other threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Official patches are available and should be applied to affected Python versions. Red Hat and Ubuntu have released updated python3 packages that fix this issue. Users should update to the patched versions as specified in vendor advisories. No additional mitigation is required beyond applying these updates.
Description
CVE-2024-8088 is a denial of service vulnerability in the CPython zipfile module's zipfile.Path API. It causes an infinite loop when iterating over entries in a maliciously crafted zip archive, impacting reading metadata or extracting contents. The more commonly used zipfile.ZipFile class is not affected. This vulnerability affects multiple Python versions prior to patched releases and is relevant when handling untrusted zip files. Official patches are available from vendors including Red Hat and Ubuntu.
References
- access.redhat.com/errata/RHSA-2024:9371 (opens in a new tab)
- docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=2307370 (opens in a new tab)
- issues.redhat.com/browse/RHEL-40750 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9371.json (opens in a new tab)
- ubuntu.com/security/CVE-2024-8088 (opens in a new tab)
- cve.org/CVERecord?id=CVE-2024-8088 (opens in a new tab)
- mail.python.org/archives/list/security-announce@python.org/thread/GNFCKVI4TCATKQLALJ5SN4L4CSPSMILU/ (opens in a new tab)
- github.com/python/cpython/pull/122906 (opens in a new tab)
- ubuntu.com/security/notices/USN-7015-1 (opens in a new tab)
- suse.com/support/security/rating/ (opens in a new tab)
- ftp.suse.com/pub/projects/security/csaf/rhsa-2024_9371.json (opens in a new tab)
- lists.suse.com/pipermail/suse-liberty-linux-updates/2024-November/000217.html (opens in a new tab)
- suse.com/security/cve/CVE-2024-8088/ (opens in a new tab)