# Zlib CVE-2023-45853

**URL:** <https://forum.anaconda.com/t/zlib-cve-2023-45853/73249>\
**Category:** Packages & Environments\
**Created:** [May 22, 2024, 2:10pm UTC](https://forum.anaconda.com/t/zlib-cve-2023-45853/73249 "2024-05-22T14:10:50Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mskalicky](https://avatars.discourse-cdn.com/v4/letter/m/80bc00/32.png) [@mskalicky](https://forum.anaconda.com/u/mskalicky)\
**Post date:** [May 22, 2024, 2:10pm UTC](https://forum.anaconda.com/t/zlib-cve-2023-45853/73249/1 "2024-05-22T14:10:50Z")

</div>

Hi,  
the python package available in conda repos (including conda-forge) is depending on zlib \<1.3 which is affected by CVE-2023-45853 which was published in October 2023.  
Is there any plan to rebuild python in conda repo to use newer zlib?

I was able to find that CPython was rebuilding and backporting the changes even though they thought this CVE is not affecting them

> <https://github.com/python/cpython/issues/111239>
>
> \# Bug report
> 
> \### Bug description:
> 
> A new version of zlib is out: 1.3 - https://…zlib.net/
> 
> zlib 1.2.13 has \[CVE-2023-45853\](https://nvd.nist.gov/vuln/detail/CVE-2023-45853)
> https://www.openwall.com/lists/oss-security/2023/10/20/9
> 
> minizip is part of the contrib directory in zlib, but we do not appear to use this API. The CVSS v3 score is 9.8.
> 
> We would rather patch Python to use the latest library because people will ask us about that CVE.
> 
> 
> 
> \### CPython versions tested on:
> 
> 3.11, 3.12, 3.13
> 
> \### Operating systems tested on:
> 
> Linux, Windows
> 
> 
> \### Linked PRs
> \* gh-111242
> \* gh-114877
> \* gh-115076
> \* gh-115079
> \* gh-115080
> \* gh-115086
> \* gh-115087