Python: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 4

• Critical 9.4
  CVE-2025-4517 Public exploit

  Arbitrary writes via tarfile realpath overflow

  Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() usin…

  Python Software Foundation CPython python3 python3.12 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 3, 2025
• High 7.5
  CVE-2025-4330

  Extraction filter bypass for linking outside extraction directory

  Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives u…

  Python Software Foundation CPython python3 python3.12 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 3, 2025
• High 7.5
  CVE-2025-4435

  Tarfile extracts filtered members when errorlevel=0

  When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted. However the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member would still…

  Python Software Foundation CPython python3 python3.12 Debian Ubuntu Azure Linux Wolfi
  Jun 3, 2025
• Medium 5.3
  CVE-2024-12718

  Bypass extraction filter to modify file metadata outside extraction directory

  Allows modifying some file metadata (e.g. last modified) with filter="data" or file permissions (chmod) with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar ar…

  Python Software Foundation CPython python3 python3.12 Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 3, 2025

Revision history

1. 2026-10-19 #39

   Neue Updates von SUSE aufgenommen

2. 2026-10-06 #38

   Neue Updates von SUSE aufgenommen

3. 2026-09-20 #37

   Neue Updates von SUSE aufgenommen

4. 2026-09-13 #36

   Neue Updates von IBM aufgenommen

5. 2026-08-13 #35

   Neue Updates von Red Hat aufgenommen

6. 2026-07-12 #34

   Neue Updates von Red Hat aufgenommen

7. 2026-07-09 #33

   Neue Updates von IBM aufgenommen

8. 2026-02-22 #32

   Exploit aufgenommen

9. 2026-01-22 #31

   Neue Updates von SUSE aufgenommen

10. 2026-01-21 #30

    Neue Updates von Red Hat aufgenommen

11. 2025-12-28 #29

    Neue Updates von Oracle Linux aufgenommen

12. 2025-12-17 #28

    Neue Updates von Red Hat aufgenommen

13. 2025-12-04 #27

    Neue Updates von Red Hat aufgenommen

14. 2025-11-09 #26

    Neue Updates von openSUSE aufgenommen

15. 2025-11-04 #25

    Neue Updates von Dell aufgenommen

16. 2025-10-30 #24

    Neue Updates von Dell aufgenommen

17. 2025-10-16 #23

    Neue Updates von Red Hat aufgenommen

18. 2025-09-02 #22

    Neue Updates von Oracle Linux aufgenommen

19. 2025-08-20 #21

    Neue Updates von IBM aufgenommen

20. 2025-08-12 #20

    Neue Updates von SUSE aufgenommen

21. 2025-08-11 #19

    Neue Updates von IBM aufgenommen

22. 2025-08-06 #18

    Neue Updates von IBM und SUSE aufgenommen

23. 2025-08-05 #17

    Neue Updates von SUSE aufgenommen

24. 2025-07-27 #16

    Neue Updates von SUSE aufgenommen

25. 2025-07-21 #15

    Neue Updates von SUSE aufgenommen

References

• Ubuntu Security Notice USN-7583-1 vom 2025-06-19
  https://ubuntu.com/security/notices/USN-7583-1
• SUSE Security Update SUSE-SU-2025:02057-1 vom 2025-06-23
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021620.html
• SUSE Security Update SUSE-SU-2025:02074-1 vom 2025-06-24
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021627.html
• SUSE Security Update SUSE-SU-2025:02050-1 vom 2025-06-20
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021612.html
• SUSE Security Update SUSE-SU-2025:02049-1 vom 2025-06-20
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021613.html
• SUSE Security Update SUSE-SU-2025:02047-1 vom 2025-06-20
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021615.html
• SUSE Security Update SUSE-SU-2025:02048-1 vom 2025-06-20
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021614.html
• Python Mailing List vom 2025-06-03
  https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/
• Red Hat Bugtracker vom 2025-06-03
  https://bugzilla.redhat.com/show_bug.cgi?id=2370010
• GitHub Advisory Database vom 2025-06-03
  https://github.com/advisories/GHSA-p72v-37h5-753v
• Red Hat Bugtracker vom 2025-06-03
  https://bugzilla.redhat.com/show_bug.cgi?id=2370016
• GitHub Advisory Database vom 2025-06-03
  https://github.com/advisories/GHSA-6r6c-684h-9j7p
• Red Hat Bugtracker vom 2025-06-03
  https://bugzilla.redhat.com/show_bug.cgi?id=2370013
• GitHub Advisory Database vom 2025-06-03
  https://github.com/advisories/GHSA-2pg8-h2j6-28xm
• Red Hat Bugtracker vom 2025-06-03
  https://bugzilla.redhat.com/show_bug.cgi?id=2370014
• Python Mailing List vom 2025-06-03
  https://pythoninsider.blogspot.com/2025/06/python-3134-31211-31113-31018-and-3923.html
• Fedora Security Advisory FEDORA-2025-098FA1945A vom 2025-06-05
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-098fa1945a
• Fedora Security Advisory FEDORA-2025-47CF891973 vom 2025-06-05
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-47cf891973
• Gentoo Linux Security Advisory GLSA-202506-07 vom 2025-06-12
  https://security.gentoo.org/glsa/202506-07
• Red Hat Security Advisory RHSA-2025:9918 vom 2025-06-30
  https://access.redhat.com/errata/RHSA-2025:9918
• Red Hat Security Advisory RHSA-2025:10026 vom 2025-07-01
  https://access.redhat.com/errata/RHSA-2025:10026
• Red Hat Security Advisory RHSA-2025:10031 vom 2025-07-01
  https://access.redhat.com/errata/RHSA-2025:10031
• Red Hat Security Advisory RHSA-2025:10028 vom 2025-07-01
  https://access.redhat.com/errata/RHSA-2025:10028
• Red Hat Security Advisory RHSA-2025:10136 vom 2025-07-02
  https://access.redhat.com/errata/RHSA-2025:10136
• Oracle Linux Security Advisory ELSA-2025-10026 vom 2025-07-01
  https://linux.oracle.com/errata/ELSA-2025-10026.html
• Red Hat Security Advisory RHSA-2025:10140 vom 2025-07-02
  https://access.redhat.com/errata/RHSA-2025:10140
• Red Hat Security Advisory RHSA-2025:10128 vom 2025-07-01
  https://access.redhat.com/errata/RHSA-2025:10128
• Oracle Linux Security Advisory ELSA-2025-10136 vom 2025-07-02
  https://linux.oracle.com/errata/ELSA-2025-10136.html
• Red Hat Security Advisory RHSA-2025:10148 vom 2025-07-02
  https://access.redhat.com/errata/RHSA-2025:10148
• Oracle Linux Security Advisory ELSA-2025-10031 vom 2025-07-02
  https://linux.oracle.com/errata/ELSA-2025-10031.html
• Red Hat Security Advisory RHSA-2025:10189 vom 2025-07-02
  https://access.redhat.com/errata/RHSA-2025:10189
• Oracle Linux Security Advisory ELSA-2025-10128 vom 2025-07-02
  https://linux.oracle.com/errata/ELSA-2025-10128.html
• Oracle Linux Security Advisory ELSA-2025-10148 vom 2025-07-02
  https://linux.oracle.com/errata/ELSA-2025-10148.html
• Oracle Linux Security Advisory ELSA-2025-10189 vom 2025-07-02
  https://linux.oracle.com/errata/ELSA-2025-10189.html
• Oracle Linux Security Advisory ELSA-2025-10140 vom 2025-07-03
  https://linux.oracle.com/errata/ELSA-2025-10140.html
• openSUSE Security Update OPENSUSE-SU-2025:15290-1 vom 2025-07-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YRLR7CL5RFZSB5X6YMWCVABXKQ5FKF2I/
• openSUSE Security Update OPENSUSE-SU-2025:15285-1 vom 2025-07-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4EYQQWPXUKY2S5AP6NQZE7WC5JRTWWOL/
• openSUSE Security Update OPENSUSE-SU-2025:15289-1 vom 2025-07-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AA3OOWAMM63YT2HIWXCYZDBM54EHICYV/
• openSUSE Security Update OPENSUSE-SU-2025:15286-1 vom 2025-07-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/I7RWPSXWDA2EWFPRF5WFZS53U5D5N74B/
• openSUSE Security Update OPENSUSE-SU-2025:15288-1 vom 2025-07-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IK42QIUODB7F35JVB7BXAARPKHOCCQLB/
• openSUSE Security Update OPENSUSE-SU-2025:15287-1 vom 2025-07-05
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JWQ23JUZIMA2GXE5S5DAQ7WG7JDDNDNW/
• Fedora Security Advisory FEDORA-2025-266A1353A1 vom 2025-07-04
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-266a1353a1
• Fedora Security Advisory FEDORA-2025-A8ABFBB35C vom 2025-07-04
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-a8abfbb35c
• Red Hat Security Advisory RHSA-2025:10484 vom 2025-07-08
  https://access.redhat.com/errata/RHSA-2025:10484
• Red Hat Security Advisory RHSA-2025:10399 vom 2025-07-07
  https://access.redhat.com/errata/RHSA-2025:10399
• Red Hat Security Advisory RHSA-2025:10602 vom 2025-07-08
  https://access.redhat.com/errata/RHSA-2025:10602
• SUSE Security Update SUSE-SU-2025:02297-1 vom 2025-07-11
  https://lists.suse.com/pipermail/sle-security-updates/2025-July/021800.html
• Red Hat Security Advisory RHSA-2025:11386 vom 2025-07-17
  https://access.redhat.com/errata/RHSA-2025:11386
• NetApp Security Advisory NTAP-20250718-0008 vom 2025-07-18
  https://security.netapp.com/advisory/NTAP-20250718-0008
• NetApp Security Advisory NTAP-20250718-0009 vom 2025-07-18
  https://security.netapp.com/advisory/NTAP-20250718-0009
• NetApp Security Advisory NTAP-20250718-0007 vom 2025-07-18
  https://security.netapp.com/advisory/NTAP-20250718-0007
• SUSE Security Update SUSE-SU-2025:02427-1 vom 2025-07-21
  https://lists.suse.com/pipermail/sle-security-updates/2025-July/021896.html
• SUSE Security Update SUSE-SU-2025:20492-1 vom 2025-07-25
  https://lists.suse.com/pipermail/sle-security-updates/2025-July/021968.html
• SUSE Security Update SUSE-SU-2025:20539-1 vom 2025-08-05
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022105.html
• IBM Security Bulletin 7241589 vom 2025-08-06
  https://www.ibm.com/support/pages/node/7241589
• SUSE Security Update SUSE-SU-2025:02717-1 vom 2025-08-06
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/L2NLBYO6X4C452ZDTZWTPSMMIOSSOPDD/
• IBM Security Bulletin 7242015 vom 2025-08-12
  https://www.ibm.com/support/pages/node/7242015
• SUSE Security Update SUSE-SU-2025:02767-1 vom 2025-08-12
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022140.html
• SUSE Security Update SUSE-SU-2025:02778-1 vom 2025-08-13
  https://lists.suse.com/pipermail/sle-security-updates/2025-August/022149.html
• IBM Security Bulletin 7242672 vom 2025-08-20
  https://www.ibm.com/support/pages/node/7242672
• Oracle Linux Security Advisory ELSA-2025-14984 vom 2025-09-02
  https://linux.oracle.com/errata/ELSA-2025-14984.html
• Red Hat Security Advisory RHSA-2025:18219 vom 2025-10-16
  https://access.redhat.com/errata/RHSA-2025:18219
• Dell Security Advisory DSA-2025-404 vom 2025-10-31
  https://www.dell.com/support/kbdoc/000385435
• Dell Security Advisory DSA-2025-390 vom 2025-11-05
  https://www.dell.com/support/kbdoc/000385230
• openSUSE Security Update OPENSUSE-SU-2025:15713-1 vom 2025-11-08
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/V7NUQ3GPXSJ6QCFNNBJQ5D3UZXUYCUBE/
• Red Hat Security Advisory RHSA-2025:22759 vom 2025-12-04
  https://access.redhat.com/errata/RHSA-2025:22759
• Red Hat Security Advisory RHSA-2025:23530 vom 2025-12-18
  https://access.redhat.com/errata/RHSA-2025:23530
• Rocky Linux Security Advisory RLSA-2025:23530 vom 2025-12-18
  https://errata.build.resf.org/RLSA-2025:23530
• Oracle Linux Security Advisory ELSA-2025-23530 vom 2025-12-25
  http://linux.oracle.com/errata/ELSA-2025-23530.html
• Red Hat Security Advisory RHSA-2026:0934 vom 2026-01-22
  https://access.redhat.com/errata/RHSA-2026:0934
• SUSE Security Update SUSE-SU-2026:0210-1 vom 2026-01-22
  https://lists.suse.com/pipermail/sle-security-updates/2026-January/023842.html
• PoC auf GitHub vom 2026-02-22
  https://github.com/ben-slates/CVE-2025-4517-POC
• IBM Security Bulletin 7279712 vom 2026-07-10
  https://www.ibm.com/support/pages/node/7279712
• Red Hat Security Advisory RHSA-2026:38090 vom 2026-07-10
  https://access.redhat.com/errata/RHSA-2026:38090
• Red Hat Security Advisory RHSA-2026:38091 vom 2026-07-10
  https://access.redhat.com/errata/RHSA-2026:38091
• Red Hat Security Advisory RHSA-2026:54760 vom 2026-08-13
  https://access.redhat.com/errata/RHSA-2026:54760
• IBM Security Bulletin 7287209 vom 2026-09-11
  https://www.ibm.com/support/pages/node/7287209
• IBM Security Bulletin 7287318 vom 2026-09-14
  https://www.ibm.com/support/pages/node/7287318
• SUSE Security Update SUSE-SU-2026:23743-1 vom 2026-09-21
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029285.html
• SUSE Security Update SUSE-SU-2026:4534-1 vom 2026-10-06
  https://lists.suse.com/pipermail/sle-security-updates/2026-October/029610.html