{"id":"GHSA-q5fm-55c2-v6j9","summary":"Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib","details":"### Summary\nVulnerability scan of fiona shows [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853). The vulnerability is in GDAL, a dependency of fiona.\n\n### Details\nFiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.\n\nThe Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.\n\n### Impact\nSystems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.","modified":"2024-12-01T05:24:22.436542Z","published":"2024-07-16T19:32:45Z","database_specific":{"cwe_ids":["CWE-1395","CWE-190"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2024-07-16T19:32:45Z","nvd_published_at":null},"references":[{"type":"WEB","url":"https://github.com/Toblerity/Fiona/security/advisories/GHSA-q5fm-55c2-v6j9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45853"},{"type":"WEB","url":"https://github.com/OSGeo/gdal/commit/4aa7ca61c1d2191baf1eea2a97d0dec33a41691f"},{"type":"WEB","url":"https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c"},{"type":"PACKAGE","url":"https://github.com/Toblerity/Fiona"}],"affected":[{"package":{"name":"fiona","ecosystem":"PyPI","purl":"pkg:pypi/fiona"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10b1"}]}],"versions":["0.10","0.12","0.12.1","0.13","0.14","0.15","0.16","0.16.1","0.5","0.6","0.6.1","0.6.2","0.7","0.8","0.9","0.9.1","1.0","1.0.1","1.0.2","1.0.3","1.1","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.10a1","1.10a2","1.2.0","1.3.0","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.5.0","1.5.1","1.6.0","1.6.1","1.6.2","1.6.3","1.6.3.post1","1.6.4","1.7.0","1.7.0.post1","1.7.0.post2","1.7.1","1.7.1.post1","1.7.10","1.7.10.post1","1.7.11","1.7.11.post1","1.7.11.post2","1.7.12","1.7.13","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.7.9","1.7.9.post1","1.8.0","1.8.1","1.8.10","1.8.11","1.8.12","1.8.13","1.8.13.post1","1.8.14","1.8.15","1.8.16","1.8.17","1.8.18","1.8.19","1.8.2","1.8.20","1.8.21","1.8.22","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.8.8","1.8.9","1.8.9.post1","1.8.9.post2","1.8b1","1.8b2","1.8rc1","1.9.0","1.9.1","1.9.2","1.9.3","1.9.4","1.9.4.post1","1.9.5","1.9.6","1.9a1","1.9a2","1.9a3","1.9b1","1.9b2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-q5fm-55c2-v6j9/GHSA-q5fm-55c2-v6j9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}