Bug#1118432: jython: CVE-2025-8291

[Salvatore Bonaccorso]

Source: jython
Version: 2.7.3+repack1-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for jython.

CVE-2025-8291[0]:
| The 'zipfile' module would not check the validity of the ZIP64 End
| of Central Directory (EOCD) Locator record offset value would not be
| used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record
| would be assumed to be the previous record in the ZIP archive. This
| could be abused to create ZIP archives that are handled differently
| by the 'zipfile' module compared to other ZIP implementations.
| Remediation maintains this behavior, but checks that the offset
| specified in the ZIP64 EOCD Locator record matches the expected
| value.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-8291
    https://www.cve.org/CVERecord?id=CVE-2025-8291

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore