CVE-2023-0450: 
GitLab vulnerability analysis and mitigation

The vulnerability CVE-2023-0450 affects Python's zipfile module in versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The vulnerability is related to the module's handling of zip-bombs, specifically the 'quoted-overlap' type, which can create archives with extremely high compression ratios (Python Security).

The vulnerability exists in the CPython zipfile module where it fails to properly handle 'quoted-overlap' zip-bombs. These zip-bombs exploit the zip format to achieve unusually high compression ratios by creating overlapping entries in the archive. The issue was addressed in Python versions 3.10.14, 3.9.19, and 3.8.19 by implementing protection that raises a BadZipFile exception when attempting to read an entry that overlaps with another entry or central directory (Python Security).

The vulnerability can lead to denial of service attacks through the exploitation of zip-bombs with extremely high compression ratios. When the affected versions of Python attempt to process these maliciously crafted zip files, it can result in excessive resource consumption (Red Hat Advisory).

The vulnerability has been fixed in Python versions 3.10.14, 3.9.19, and 3.8.19. The fix involves making the zipfile module reject zip archives that contain overlapping entries. Users are advised to upgrade to these patched versions to protect against this vulnerability (Python Security).