An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.

The zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.


# Bug report

### Bug description:

Just found this vulnerability in the latest Python 3.11.5 (and previous 3.10.10).

If we craft a zipbomb using the "quoted-overlap" way (as mentioned [https://www.bamsoftware.com/hacks/zipbomb/](https://urldefense.com/v3/__https://www.bamsoftware.com/hacks/zipbomb/__;!!ACWV5N9M2RV99hQ!NeHC7dlBypbGhcmQALXGCNyt3gJ-N86F3rJ3GczFSLYbl0kR34I67_YZCxbseU0GGIxRGc4gcPu4Sw$)), this can't be detected by Python's zip file and the zip will be extracted and thus potentially cause a DoS attack by consuming all the storage.

This issue is related to CVE-2019-9674 but not the same. CVE-2019-9674 is talking about the "normal" overlap-zipbomb which is a "full" overlap. This can already be detected by Python's new version of zipfile. However, when we craft a "quoted-overlap" zip, as indicated by [https://www.bamsoftware.com/hacks/zipbomb/](https://urldefense.com/v3/__https://www.bamsoftware.com/hacks/zipbomb/__;!!ACWV5N9M2RV99hQ!NeHC7dlBypbGhcmQALXGCNyt3gJ-N86F3rJ3GczFSLYbl0kR34I67_YZCxbseU0GGIxRGc4gcPu4Sw$), python can't detect and happily starts to extract.

For example, the following is the python to extract a zip file, 116 KB before extraction, goes to as large as 17GB after extraction. The size after extraction can be easily increased to multi TBs or even PBs by adjusting the zip-creation.

```python
import zipfile
import sys
import os

def extract_zip(zip_path):
    """
    Extracts the contents of a ZIP file to the current directory.

    :param zip_path: Path to the ZIP file
    """
    if not os.path.exists(zip_path):
        print(f"Error: {zip_path} does not exist.")
        return

    with zipfile.ZipFile(zip_path, 'r') as zip_ref:
        zip_ref.extractall()
        print(f"Extracted contents of {zip_path} to the current directory.")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python extract_zip.py <path_to_zip_file>")
        sys.exit(1)

    zip_file_path = sys.argv[1]
    extract_zip(zip_file_path)
```


### CPython versions tested on:

3.11

### Operating systems tested on:

Linux

<!-- gh-linked-prs -->
### Linked PRs
* gh-110016
* gh-113912
* gh-113913
* gh-113914
* gh-113915
* gh-113916
* gh-113918
<!-- /gh-linked-prs -->

Python "zipfile" can't detect "quoted-overlap" zipbomb that can be used as a DoS attack
This is a GitHub Issue
repo:cpython
owner:python
Title : Python "zipfile" can't detect "quoted-overlap" zipbomb that can be used as a DoS attack
Issue date:

--- start body ---
# Bug report

### Bug description:

Just found this vulnerability in the latest Python 3.11.5 (and previous 3.10.10).

If we craft a zipbomb using the "quoted-overlap" way (as mentioned [https://www.bamsoftware.com/hacks/zipbomb/](https://urldefense.com/v3/__https://www.bamsoftware.com/hacks/zipbomb/__;!!ACWV5N9M2RV99hQ!NeHC7dlBypbGhcmQALXGCNyt3gJ-N86F3rJ3GczFSLYbl0kR34I67_YZCxbseU0GGIxRGc4gcPu4Sw$)), this can't be detected by Python's zip file and the zip will be extracted and thus potentially cause a DoS attack by consuming all the storage.

This issue is related to CVE-2019-9674 but not the same. CVE-2019-9674 is talking about the "normal" overlap-zipbomb which is a "full" overlap. This can already be detected by Python's new version of zipfile. However, when we craft a "quoted-overlap" zip, as indicated by [https://www.bamsoftware.com/hacks/zipbomb/](https://urldefense.com/v3/__https://www.bamsoftware.com/hacks/zipbomb/__;!!ACWV5N9M2RV99hQ!NeHC7dlBypbGhcmQALXGCNyt3gJ-N86F3rJ3GczFSLYbl0kR34I67_YZCxbseU0GGIxRGc4gcPu4Sw$), python can't detect and happily starts to extract.

For example, the following is the python to extract a zip file, 116 KB before extraction, goes to as large as 17GB after extraction. The size after extraction can be easily increased to multi TBs or even PBs by adjusting the zip-creation.

```python
import zipfile
import sys
import os

def extract_zip(zip_path):
    """
    Extracts the contents of a ZIP file to the current directory.

    :param zip_path: Path to the ZIP file
    """
    if not os.path.exists(zip_path):
        print(f"Error: {zip_path} does not exist.")
        return

    with zipfile.ZipFile(zip_path, 'r') as zip_ref:
        zip_ref.extractall()
        print(f"Extracted contents of {zip_path} to the current directory.")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python extract_zip.py <path_to_zip_file>")
        sys.exit(1)

    zip_file_path = sys.argv[1]
    extract_zip(zip_file_path)
```


### CPython versions tested on:

3.11

### Operating systems tested on:

Linux

<!-- gh-linked-prs -->
### Linked PRs
* gh-110016
* gh-113912
* gh-113913
* gh-113914
* gh-113915
* gh-113916
* gh-113918
<!-- /gh-linked-prs -->

--- end body ---

comments :
--- start comments ---

--- end comments ---