The vulnerabilities of the CompressorStreamFactory, TarArchiveInputStream, and TarFile classes in the Apache Commons Compress library allow a attacker to trigger a service failure.

The vulnerabilities of the CompressorStreamFactory, TarArchiveInputStream, and TarFile classes in the Apache Commons Compress library are related to an uncontrolled resource consumption due to insufficient validation of input data during the processing of TAR archive headers. Exploiting these...

CVE-2023-42503 Apache Commons Compress: Denial of service via CPU consumption for malformed TAR file

Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress: from 1.22 before 1.24.0. Users are recommended to upgrade to version 1.24.0, which fixes the issue. A third party can create a malformed...

Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2023-2705)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OESA-2023-1520 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2023-1519 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

OESA-2023-1518 python3 security update

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Python (CVE-2019-20907)

Summary Security Vulnerabilities affect IBM Cloud Pak for Data - Python CVE-2019-20907 Vulnerability Details CVEID:CVE-2019-20907 DESCRIPTION: Python is vulnerable to a denial of service, caused by a flaw in the tarfile module in Lib/tarfile.py. By persuading a victim to open a specially-craft a...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Pak for Data - Python (CVE-2019-20907)

Summary Security Vulnerabilities affect IBM Cloud Pak for Data - Python CVE-2019-20907 Vulnerability Details CVEID:CVE-2019-20907 DESCRIPTION: Python is vulnerable to a denial of service, caused by a flaw in the tarfile module in Lib/tarfile.py. By persuading a victim to open a specially-craft a...

SUSE-SU-2023:2937-1 Security update for python311

This update for python311 fixes the following issues: python was updated to version 3.11.4: - CVE-2023-24329: Fixed blocklist bypass via the urllib.parse component when supplying a URL that starts with blank characters bsc1208471. - CVE-2007-4559: Fixed python tarfile module directory traversal...

SUSE-SU-2023:2778-1 Security update for python311

This update for python311 fixes the following issues: - CVE-2007-4559: Fixed filter for tarfile.extractall bsc1203750...

SUSE-SU-2023:2517-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2007-4559: Fixed filter for tarfile.extractall bsc1203750. - Fixed unittest.mock.patch.dict returns function when applied to coroutines bsc1211158...

dotnet: Elevation of privilege - TarFile.ExtractToDirectory ignores extraction directory argument

A vulnerability was found in dotnet. This issue can cause an elevation of privilege when the TarFile.ExtractToDirectory ignores the extraction directory argument...

dotnet: Elevation of privilege - TarFile.ExtractToDirectory ignores extraction directory argument

A vulnerability was found in dotnet. This issue can cause an elevation of privilege when the TarFile.ExtractToDirectory ignores the extraction directory argument...

CVE-2023-32032

A vulnerability was found in dotnet. This issue can cause an elevation of privilege when the TarFile.ExtractToDirectory ignores the extraction directory argument...

SUSE-SU-2023:2473-1 Security update for python36

This update for python36 fixes the following issues: - CVE-2007-4559: Fixed filter for tarfile.extractall bsc1203750. - Fixed unittest.mock.patch.dict returns function when applied to coroutines bsc1211158...

SUSE-SU-2023:2463-1 Security update for python310

This update for python310 fixes the following issues: - CVE-2007-4559: Fixed filter for tarfile.extractall bsc1203750...

Debian dla-3432 : idle-python2.7 - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3432 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3432-1 [email protected]...

mindsdb arbitrary file write when extracting a remotely retrieved Tarball

Summary An unsafe extraction is being performed using tarfile.extractall from a remotely retrieved tarball. Which may lead to the writing of the extracted files to an unintended location. Sometimes, the vulnerability is called a TarSlip or a ZipSlip variant. Details I commented the following...

PT-2023-22817 · Mindsdb +1 · Mindsdb +1

Name of the Vulnerable Software and Affected Versions: mindsdb versions prior to 23.2.1.0 Description: The issue is related to an unsafe extraction performed using tarfile.extractall from a remotely retrieved tarball, which may lead to the writing of extracted files to an unintended location. Thi...

K78284681: Python tarfile library vulnerability CVE-2019-20907

Security Advisory Description In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation. CVE-2019-20907 Impact A user-created custom Python script utilizing the Python...