CVE-2025-4435 Tarfile extracts filtered members when errorlevel=0

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped...

CVE-2025-4435

CVE-2025-4435 affects CPython tarfile: when TarFile.errorlevel=0 and a filter is used, the filter-verified members could be extracted instead of skipped. Root cause described as the extraction filter bypassing for errorlevel=0 in affected versions. Impact per CVSS: HIGH (I) with no availability o...

CVE-2025-4435

When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still be extracted and not skipped...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the tarfile module's extraction process when using the extractall or extract functions with the filter parameter set to "data" or "tar". An attacker can cause files or symlinks to be created outside the intended...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the tarfile extraction process when using the filter parameter set to "data" or "tar". An attacker can write files outside the intended extraction directory by convincing a privileged user or process to extract a...

Python 安全漏洞

Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A security vulnerability exists in Python 3.12 and later, which stems from the tarfile module extraction filter...

GHSA-75PX-35P4-QQ6H Aim External Control of File Name or Path vulnerability

A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the tarfile.extractall function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control repo.path and runhash to bypass directory existence checks and...

CVE-2024-6829 Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim

A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the tarfile.extractall function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control repo.path and runhash to bypass directory existence checks and...

CVE-2024-6829 Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim

A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the tarfile.extractall function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control repo.path and runhash to bypass directory existence checks and...

CVE-2024-6829 Arbitrary File Overwrite through tarfile-extraction in aimhubio/aim

A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the tarfile.extractall function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control repo.path and runhash to bypass directory existence checks and...

Important: Red Hat Security Advisory: Satellite 6.15.0 release

An update is now available for Red Hat Satellite 6.15. The release contains a new version of Satellite and important security fixes for various components. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base scor...

redhat-support-lib-python and redhat-support-tool bug fix and enhancement update

An update is available for redhat-support-tool, redhat-support-lib-python. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The redhat-support-tool utility...

openSUSE: Security Advisory for python310 (SUSE-SU-2023:2884-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Moderate: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

An update is now available for Red Hat Ansible Automation Platform 2.4 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2023-5189 Hub: insecure galaxy-importer tarfile extraction

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten...

CVE-2023-5189

Removed by vendor...

python3.9 security update

3.9.18-1 - Update to 3.9.18 - Security fix for CVE-2023-40217 Resolves: RHEL-3043 3.9.17-2 - Fix symlink handling in the fix for CVE-2023-24329 Resolves: rhbz263261 3.9.17-1 - Update to 3.9.17 - Security fix for CVE-2023-24329 Resolves: rhbz2173917 3.9.16-2 - Add filters for tarfile extraction...

SUSE-SU-2023:2778-1 Security update for python311

This update for python311 fixes the following issues: - CVE-2007-4559: Fixed filter for tarfile.extractall bsc1203750...

dotnet: Elevation of privilege - TarFile.ExtractToDirectory ignores extraction directory argument

A vulnerability was found in dotnet. This issue can cause an elevation of privilege when the TarFile.ExtractToDirectory ignores the extraction directory argument...

SUSE-SU-2023:2473-1 Security update for python36

This update for python36 fixes the following issues: - CVE-2007-4559: Fixed filter for tarfile.extractall bsc1203750. - Fixed unittest.mock.patch.dict returns function when applied to coroutines bsc1211158...