CyberRota Analysis
AI-GeneratedThe py7zr library, used for handling 7zip archives, is vulnerable to a denial-of-service condition due to inefficient processing of attacker-controlled numstreams values in the PackInfo._read() method, which can lead to excessive CPU consumption when initializing a SevenZipFile object. This vulnerability can be exploited through specially crafted .7z files, impacting systems that utilize this library for archive management. Organizations using py7zr versions prior to 1.1.3 should prioritize updating to mitigate potential performance degradation and service interruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.