Description
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.10.22, 3.11.0 – < 3.11.17, 3.12.0 – < 3.12.15, 3.13.0 – < 3.13.16, 3.14.0 – < 3.14.9, 3.15.0a1 – < 3.15.0rc3 | 3.10.22 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pypy3 | 8.0.1+dfsg-1 | — |
| Debian 14 | python3.14 | 3.14.9-1 | — |
| Debian 14 | python3.15 | 3.15.0~rc3-1 | — |
| Debian 13 | pypy3 +1 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | pypy3 +1 | No fix yet | — |
| Ubuntu 26.04 LTS | pypy3 +1 | No fix yet | — |
| Ubuntu 24.04 LTS | pypy3 +1 | No fix yet | — |
| Ubuntu 22.04 LTS | pypy3 +1 | No fix yet | — |
| Ubuntu 20.04 LTS | pypy3 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python2.7 +2 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python2.7 +3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python2.7 +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python2.7 +2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | python3 +15 | 3.14.7-1.2.hum1 | RHSA-2026:67572 |
| Red Hat Hardened Images 1 | python3.10 +6 | 3.10.21-1.2.hum1 | RHSA-2026:67574 |
| Red Hat Hardened Images 1 | python3.11 +6 | 3.11.16-1.3.hum1 | RHSA-2026:67575 |
| Red Hat Hardened Images 1 | python3.12 +6 | 3.12.14-1.2.hum1 | RHSA-2026:67607 |
| Red Hat Hardened Images 1 | python3.13 +8 | 3.13.15-1.2.hum1 | RHSA-2026:67606 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python315 | 3.15.0-1.1 | openSUSE-SU-2026:12125-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.23 | python3 | 3.12.15-r0 | — |
| Alpine v3.22 | python3 | 3.12.15-r0 | — |
| Alpine v3.21 | python3 | 3.12.15-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3.11 +6 | 3.11.17-1.amzn2023.0.1 | ALAS2023-2026-3231 |
| Amazon Linux 2023 | python3.12 +6 | 3.12.15-2.amzn2023.0.1 | ALAS2023-2026-3230 |
| Amazon Linux 2023 | python3.13 +8 | 3.13.16-1.amzn2023.0.1 | ALAS2023-2026-3229 |
| Amazon Linux 2023 | python3.14 +13 | 3.14.10-1.amzn2023.0.1 | ALAS2023-2026-3406 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python3 | 3.12.15-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | python-3.10 | 3.10.22-r1 | — |
| Wolfi rolling | python-3.11 | 3.11.17-r1 | — |
| Wolfi rolling | python-3.12 | 3.12.15-r0 | — |
| Wolfi rolling | python-3.13 | 3.13.16_git20261002-r0 | — |
| Wolfi rolling | python-3.14 | 3.14.8_git20261008-r0 | — |
Advisories 11
- ALAS2023-2026-3406 Moderate: python3.14 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 9, 2026
- ALAS2023-2026-3229 Important: python3.13 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3230 Important: python3.12 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3231 Important: python3.11 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- WID-SEC-2026-3335 CPython: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 25, 2026
- RHSA-2026:67572 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- openSUSE-SU-2026:12125-1 python315-3.15.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 14, 2026
- RHSA-2026:67607 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:67574 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:67575 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- RHSA-2026:67606 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Sep 22, 2026
References
- https://mail.python.org/archives/list/security-announce@python.org/thread/57TBTLL2W6APMZR3A25B2YV7GL3EPTDJ/ vendor-advisory
- https://github.com/python/cpython/pull/157266 patch
- https://github.com/python/cpython/issues/157265 issue-tracking
- https://github.com/python/cpython/commit/d9565e54b1fc6d63c5be9afd58114499128fa57b patch
- https://github.com/python/cpython/commit/fb2f0bbc3b35264f09cc2cb2934b7987527a6bc2 patch
- https://github.com/python/cpython/commit/9c17bace90f88dfba6d0e2fe23c8e7ae35f83955 patch
- https://github.com/python/cpython/commit/764fd0af8d9e19d3684a58d2e58bf770f0605036 patch
- https://github.com/python/cpython/commit/2eb0c2f1dc71847731b6ab30aebefd058d482a7f patch
- https://github.com/python/cpython/commit/c1f106d240c4ffcb3608ed0a20e8aba6c865f6d3 patch
- https://github.com/python/cpython/commit/3105a3498aaf681ce128cf5baf83c2e5574267c5 patch
- https://github.com/python/cpython/commit/a4919937a4e1e69a0d178909c6f20557eca5d1d0 patch