TI-2024-11791 CVE-2024-12718 · GHSA-2pg8-h2j6-28xm
Bypass extraction filter to modify file metadata outside extraction directory
Priority MEDIUM 63
Allows modifying some file metadata (e.g.
RHSA-2025:10484
python3 security update
Released 2025-07-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.6) platform-python-3.6.8-47.el8_6.8, platform-python-debug-3.6.8-47.el8_6.8, platform-python-devel-3.6.8-47.el8_6.8 +3
- Red Hat Enterprise Linux AppStream E4S (v.8.6) platform-python-3.6.8-47.el8_6.8, platform-python-debug-3.6.8-47.el8_6.8, platform-python-devel-3.6.8-47.el8_6.8 +3
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) platform-python-3.6.8-47.el8_6.8, platform-python-debug-3.6.8-47.el8_6.8, platform-python-devel-3.6.8-47.el8_6.8 +3
- Red Hat Enterprise Linux AppStream TUS (v.8.6) platform-python-3.6.8-47.el8_6.8, platform-python-debug-3.6.8-47.el8_6.8, platform-python-devel-3.6.8-47.el8_6.8 +3
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) platform-python-3.6.8-47.el8_6.8, python3-3.6.8-47.el8_6.8, python3-libs-3.6.8-47.el8_6.8 +1
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) platform-python-3.6.8-47.el8_6.8, python3-3.6.8-47.el8_6.8, python3-libs-3.6.8-47.el8_6.8 +1
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6) platform-python-3.6.8-47.el8_6.8, python3-3.6.8-47.el8_6.8, python3-libs-3.6.8-47.el8_6.8 +1
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) platform-python-3.6.8-47.el8_6.8, python3-3.6.8-47.el8_6.8, python3-libs-3.6.8-47.el8_6.8 +1
Fixes 5 records
TI-2025-04033 CVE-2025-4517 · GHSA-6r6c-684h-9j7p
Arbitrary writes via tarfile realpath overflow
Priority MEDIUM 51
Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data".
TI-2025-03675 CVE-2025-4138 · GHSA-4g4g-fqw4-prp2
Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory
Priority MEDIUM 42
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
TI-2025-03859 CVE-2025-4330 · GHSA-68pj-xrp5-vccj
Extraction filter bypass for linking outside extraction directory
Priority MEDIUM 41
Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.
TI-2025-03954 CVE-2025-4435 · GHSA-p72v-37h5-753v
Tarfile extracts filtered members when errorlevel=0
Priority MEDIUM 40
When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted.