CVE-2019-9674

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.htmlBroken Link
https://bugs.python.org/issue36260Issue Tracking, Vendor Advisory
https://bugs.python.org/issue36462Issue Tracking, Vendor Advisory
https://github.com/python/cpython/blob/master/Lib/zipfile.pyThird Party Advisory
https://python-security.readthedocs.io/security.html#archives-and-zip-bombVendor Advisory
https://security.netapp.com/advisory/ntap-20200221-0003/Third Party Advisory
https://usn.ubuntu.com/4428-1/Third Party Advisory
https://www.python.org/news/security/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.htmlBroken Link
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.htmlBroken Link
https://bugs.python.org/issue36260Issue Tracking, Vendor Advisory
https://bugs.python.org/issue36462Issue Tracking, Vendor Advisory
https://github.com/python/cpython/blob/master/Lib/zipfile.pyThird Party Advisory
https://python-security.readthedocs.io/security.html#archives-and-zip-bombVendor Advisory
https://security.netapp.com/advisory/ntap-20200221-0003/Third Party Advisory
https://usn.ubuntu.com/4428-1/Third Party Advisory
https://www.python.org/news/security/Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Timeline

Published: Feb 4, 2020
Last modified: Oct 14, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-96758.1An issue was discovered in PHP 7.x before 7.1.27 and 7.3.x before 7.3.3. phar_tar_writeheaders_int in ext/phar/tar.c has a buffer overflow v CVE-2019-96767.8Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerabil CVE-2019-96779.8The specific fields of CGI interface of some Dahua products are not strictly verified, an attacker can cause a buffer overflow by constructi CVE-2019-96787.5Some Dahua products have the problem of denial of service during the login process. An attacker can cause a device crashed by constructing a CVE-2019-96798.8Some of Dahua's Debug functions do not have permission separation. Low-privileged users can use the Debug function after logging in. Affecte CVE-2019-96805.3Some Dahua products have information leakage issues. Attackers can obtain the IP address and device model information of the device by const CVE-2019-96815.3Online upgrade information in some firmware packages of Dahua products is not encrypted. Attackers can obtain this information by analyzing CVE-2019-96828.1Dahua devices with Build time before December 2019 use strong security login mode by default, but in order to be compatible with the normal CVE-2019-96868.8pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U <url>" due to an unsanitized CVE-2019-96879.8PoDoFo 0.9.6 has a heap-based buffer overflow in PdfString::ConvertUTF16toUTF8 in base/PdfString.cpp.CVE-2019-96888.8sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=add_post CSRF to add an admin account.CVE-2019-96897.5process_certificate in tls1.c in Cameron Hamilton-Rich axTLS through 2.1.5 has a Buffer Overflow via a crafted TLS certificate handshake mes