Skip to content
OpenAdvisories
High ALAS2023-2025-1136 1 CVE

Important: python3.11 security update (Amazon Linux 2023)

Published Aug 5, 2025 · Updated Aug 18, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-8194: There is a defect in the CPython "tarfile" module affecting the "TarFile" extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability can be mitigated by including the following patch after importing the "tarfile" module: https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1

Fixed packages 9

ReleasePackageFixed in
Amazon Linux · 2023 python3.11 0:3.11.13-1.amzn2023.0.3
Amazon Linux · 2023 python3.11-debug 0:3.11.13-1.amzn2023.0.3
Amazon Linux · 2023 python3.11-debuginfo 0:3.11.13-1.amzn2023.0.3
Amazon Linux · 2023 python3.11-debugsource 0:3.11.13-1.amzn2023.0.3
Amazon Linux · 2023 python3.11-devel 0:3.11.13-1.amzn2023.0.3
Amazon Linux · 2023 python3.11-idle 0:3.11.13-1.amzn2023.0.3
Amazon Linux · 2023 python3.11-libs 0:3.11.13-1.amzn2023.0.3
Amazon Linux · 2023 python3.11-test 0:3.11.13-1.amzn2023.0.3
Amazon Linux · 2023 python3.11-tkinter 0:3.11.13-1.amzn2023.0.3

Vulnerabilities 1

  • High 7.5
    CVE-2025-8194

    Tarfile infinite loop during parsing with negative member offset

    There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archives with negative offsets without error, resulting in an infinite loop and deadlock during the parsi…

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-8194.html