Threat database

CVE-2024-8088 is a denial of service vulnerability in the CPython zipfile module's zipfile.Path API. It causes an infinite loop when iterating over entries in a maliciously crafted zip archive, impacting reading metadata or extracting contents. The more commonly used zipfile.ZipFile class is not affected. This vulnerability affects multiple Python versions prior to patched releases and is relevant when handling untrusted zip files. Official patches are available from vendors including Red Hat and Ubuntu.

CVE-2024-6923 is a medium severity vulnerability affecting the email module in CPython, including Python 2.7 and other versions. The issue involves improper quoting of newlines in email headers during serialization, which can lead to header injection. Fixes for this vulnerability are available from Red Hat and Ubuntu for affected versions.