Python and PyPy Updates Fix ZIP-Bomb and Symlink Vulnerabilities

Python and Debian released security updates addressing denial-of-service and unsafe temporary-directory cleanup vulnerabilities across Python runtimes. Python 3.10.14, 3.9.19, and 3.8.19 fix CVE-2024-0450, which allows specially crafted quoted-overlap ZIP archives to cause denial of service, and CVE-2023-6597, which involves unsafe symlink dereferencing during temporary-directory cleanup and could permit file-permission changes in certain privileged applications. These releases also update bundled libexpat to 2.6.0 to address CVE-2023-52425 and resolve additional runtime issues. Python 3.11 and 3.12 were identified as affected by the ZIP-bomb and cleanup flaws, with fixes still anticipated at the time of the upstream announcement.

Debian backported fixes for CVE-2023-6597 and CVE-2024-0450 to Python 3.7 on Debian 10 buster in 3.7.3-2+deb10u7, under advisory DLA-3772-1. A separate advisory, DLA-3948-1, fixes four vulnerabilities in PyPy3 on Debian 11 bullseye: symlink-related file-permission changes, URL blocklist bypass, TLS client authentication bypass, and resource exhaustion from specially crafted high-compression ZIP archives. The fixed PyPy3 version is 7.3.5+dfsg-2+deb11u3. Administrators should upgrade affected packages and prioritize applications that process untrusted archives or perform privileged temporary-directory cleanup. The PyPy3 advisory did not report active exploitation.