CVE-2024-39133

What it actually does

Heap buffer overflow in the __zzip_parse_root_directory function allows malformed ZIP input to trigger memory corruption and application crashes.

Why it matters to the business

Service availability can be disrupted when applications processing untrusted archives are forced to crash, with limited risk of data exposure or integrity loss.

How an attack unfolds

An attacker supplies a specially crafted ZIP archive that reaches the root directory parser; the overflow occurs during parsing and results in a denial-of-service condition.

How to fix it

Upgrade affected putty packages on Alpine v3.16 and v3.17 to version 0.81-r0 or later; rebuild or update any downstream packages that embed the vulnerable zziplib library.

How to confirm the fix worked

Verify installed package versions match or exceed the stated fixed releases, then test archive parsing with known-malformed inputs to confirm absence of crashes.

Typical attack path

1. Obtain or generate a malicious ZIP archive targeting the vulnerable parser
2. Deliver the archive to the target application via network, file share, or local input
3. Trigger parsing of the archive root directory through normal application processing
4. Cause heap corruption that leads to process termination

How to detect it

Review application and system logs for unexpected process terminations or segmentation faults during ZIP archive handling; correlate with file access timestamps of untrusted archives.

What your security team should do

• Apply the listed package upgrades immediately on all Alpine-based systems running the affected putty versions
• Scan build pipelines and container images for older zziplib or putty dependencies
• Prioritize patching in environments that process untrusted archives
• Monitor upstream zziplib releases for additional fixes beyond the putty packaging update