Summary
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* cpython: Tarfile extracts filtered members when errorlevel=0 (CVE-2025-4435)
* cpython: Bypass extraction filter to modify file metadata outside extraction directory (CVE-2024-12718)
* cpython: Extraction filter bypass for linking outside extraction directory (CVE-2025-4330)
* python: cpython: Arbitrary writes via tarfile realpath overflow (CVE-2025-4517)
* cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory (CVE-2025-4138)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | python3.9 | 0:3.9.21-2.el9_6.1 |
Vulnerabilities 5
-
Critical 9.4CVE-2025-4517 Public exploit
Arbitrary writes via tarfile realpath overflow
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() usin…
-
High 7.5CVE-2025-4138 Public exploit
Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives u…
-
High 7.5
Extraction filter bypass for linking outside extraction directory
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives u…
-
High 7.5
Tarfile extracts filtered members when errorlevel=0
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still…
-
Medium 5.3
Bypass extraction filter to modify file metadata outside extraction directory
Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar ar…