Veracode Vulnerability DatabaseVERACODE:43894Directory Traversal
Python is vulnerable to directory traversal attack. The vulnerability is due to the extract and extractall functions in the tarfile module which allows an attacker to overwrite arbitrary files via a dot dot(…) sequence. The vulnerability results in an arbitrary file overwrite.
References
mail.python.org/pipermail/python-dev/2007-August/074290.html
mail.python.org/pipermail/python-dev/2007-August/074292.html
secunia.com/advisories/26623
www.vupen.com/english/advisories/2007/3022
bugzilla.redhat.com/show_bug.cgi?id=263261
github.com/python/cpython/commit/af530469954e8ad49f1e071ef31c844b9bfda414
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVBB7NU3YIRRDOKLYVN647WPRR3IAKR6/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FI55PGL47ES3OU2FQPGEHOI2EK3S2OBH/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KA4Z44ZAI4SY7THCFBUDNT5EEFO4XQ3A/
peps.python.org/pep-0706/
security.gentoo.org/glsa/202309-06
Related
