Summary
[3.12.9-2.0.1.2]
- Remove upstream URL reference
[3.12.9-2.2]
- Enable PAC and BTI protections for aarch64
- Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
- Resolves: RHEL-98058, RHEL-98020, RHEL-97809, RHEL-98184, RHEL-98211
[3.12.9-2.1]
- Apply Intel's CET for mitigation against control-flow hijacking attacks
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | python-unversioned-command | 0:3.12.9-2.0.1.el10_0.2 |
| Oracle Linux · 10 | python3 | 0:3.12.9-2.0.1.el10_0.2 |
| Oracle Linux · 10 | python3-debug | 0:3.12.9-2.0.1.el10_0.2 |
| Oracle Linux · 10 | python3-devel | 0:3.12.9-2.0.1.el10_0.2 |
| Oracle Linux · 10 | python3-idle | 0:3.12.9-2.0.1.el10_0.2 |
| Oracle Linux · 10 | python3-libs | 0:3.12.9-2.0.1.el10_0.2 |
| Oracle Linux · 10 | python3-test | 0:3.12.9-2.0.1.el10_0.2 |
| Oracle Linux · 10 | python3-tkinter | 0:3.12.9-2.0.1.el10_0.2 |
Vulnerabilities 5
-
Critical 9.4CVE-2025-4517 Public exploit
Arbitrary writes via tarfile realpath overflow
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() usin…
-
High 7.5CVE-2025-4138 Public exploit
Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives u…
-
High 7.5
Extraction filter bypass for linking outside extraction directory
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives u…
-
High 7.5
Tarfile extracts filtered members when errorlevel=0
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still…
-
Medium 5.3
Bypass extraction filter to modify file metadata outside extraction directory
Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar ar…