Read the docs
TI-2019-15121 Aliases CVE-2019-20907GHSA-xc97-8p9q-cf27

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive…

Priority LOW 38CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 32 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-835.

Summary

In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02956 87th percentileScored 2026-11-07
Fix Partial Red Hat: 12 advisoriesRed Hat: 32 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*3.5.0 to before 3.5.10; 3.6.0 to before 3.6.12; 3.7.0 to before 3.7.9; 3.8.0 to before 3.8.5Vulnerablepython-pillow
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
  • cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions 3.5.0 to before 3.5.10; 3.6.0 to before 3.6.12; 3.7.0 to before 3.7.9; 3.8.0 to before 3.8.5 Vulnerable ·python-pillow
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:*9.5VulnerableNetApp
cpe:2.3:a:netapp:cloud_volumes_ontap_mediator:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*8.8VulnerableOracle
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vsphere:*:* Versions 9.5 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:cloud_volumes_ontap_mediator:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle

Remediation

Red Hat 12 advisories

  • RHSA-2021:0949 Released 2021-03-22 · Red Hat rating Low
    Red Hat OpenShift Do openshift/odo-init-image 1.1.3 security update
    • OpenShift Do 1 openshiftdo/odo-init-image-rhel7
  • RHSA-2021:0881 Released 2021-03-16 · Red Hat rating Moderate
    python security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) python-2.7.5-84.el7_6, python-devel-2.7.5-84.el7_6, python-libs-2.7.5-84.el7_6
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) python-debug-2.7.5-84.el7_6, python-test-2.7.5-84.el7_6, python-tools-2.7.5-84.el7_6 +1
    • Red Hat Enterprise Linux Server EUS (v. 7.6) python-2.7.5-84.el7_6, python-devel-2.7.5-84.el7_6, python-libs-2.7.5-84.el7_6 +1
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.6) python-debug-2.7.5-84.el7_6, python-test-2.7.5-84.el7_6, python-tools-2.7.5-84.el7_6 +1
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) python-2.7.5-84.el7_6, python-devel-2.7.5-84.el7_6, python-libs-2.7.5-84.el7_6
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) python-debug-2.7.5-84.el7_6, python-test-2.7.5-84.el7_6, python-tools-2.7.5-84.el7_6 +1
  • RHSA-2021:0761 Released 2021-03-09 · Red Hat rating Moderate
    python security update
    • Red Hat Enterprise Linux Server AUS (v. 7.4) python-2.7.5-64.el7_4, python-devel-2.7.5-64.el7_4, python-libs-2.7.5-64.el7_4
    • Red Hat Enterprise Linux Server E4S (v. 7.4) python-2.7.5-64.el7_4, python-devel-2.7.5-64.el7_4, python-libs-2.7.5-64.el7_4
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.4) python-debug-2.7.5-64.el7_4, python-test-2.7.5-64.el7_4, python-tools-2.7.5-64.el7_4 +1
    • Red Hat Enterprise Linux Server Optional E4S (v. 7.4) python-debug-2.7.5-64.el7_4, python-test-2.7.5-64.el7_4, python-tools-2.7.5-64.el7_4 +1
    • Red Hat Enterprise Linux Server Optional TUS (v. 7.4) python-debug-2.7.5-64.el7_4, python-test-2.7.5-64.el7_4, python-tools-2.7.5-64.el7_4 +1
    • Red Hat Enterprise Linux Server TUS (v. 7.4) python-2.7.5-64.el7_4, python-devel-2.7.5-64.el7_4, python-libs-2.7.5-64.el7_4
Show 9 more Red Hat advisories
  • RHSA-2021:0528 Released 2021-02-16 · Red Hat rating Moderate
    python security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.7) python-2.7.5-88.el7_7, python-devel-2.7.5-88.el7_7, python-libs-2.7.5-88.el7_7
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7) python-debug-2.7.5-88.el7_7, python-test-2.7.5-88.el7_7, python-tools-2.7.5-88.el7_7 +1
    • Red Hat Enterprise Linux Server EUS (v. 7.7) python-2.7.5-88.el7_7, python-devel-2.7.5-88.el7_7, python-libs-2.7.5-88.el7_7 +1
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.7) python-debug-2.7.5-88.el7_7, python-test-2.7.5-88.el7_7, python-tools-2.7.5-88.el7_7 +1
  • RHSA-2020:5009 Released 2020-11-10 · Red Hat rating Moderate
    python security update
    • Red Hat Enterprise Linux Client (v. 7) python-2.7.5-90.el7, python-libs-2.7.5-90.el7
    • Red Hat Enterprise Linux Client Optional (v. 7) python-debug-2.7.5-90.el7, python-devel-2.7.5-90.el7, python-test-2.7.5-90.el7 +2
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) python-debug-2.7.5-90.el7, python-test-2.7.5-90.el7, python-tools-2.7.5-90.el7 +1
    • Red Hat Enterprise Linux Server (v. 7) python-2.7.5-90.el7, python-devel-2.7.5-90.el7, python-libs-2.7.5-90.el7 +1
    • Red Hat Enterprise Linux Server Optional (v. 7) python-debug-2.7.5-90.el7, python-test-2.7.5-90.el7, python-tools-2.7.5-90.el7 +1
    • Red Hat Enterprise Linux Workstation (v. 7) python-2.7.5-90.el7, python-devel-2.7.5-90.el7, python-libs-2.7.5-90.el7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) python-debug-2.7.5-90.el7, python-test-2.7.5-90.el7, python-tools-2.7.5-90.el7 +1
  • RHSA-2020:5010 Released 2020-11-10 · Red Hat rating Moderate
    python3 security update
    • Red Hat Enterprise Linux Client (v. 7) python3-3.6.8-18.el7, python3-libs-3.6.8-18.el7
    • Red Hat Enterprise Linux Client Optional (v. 7) python3-3.6.8-18.el7, python3-debug-3.6.8-18.el7, python3-devel-3.6.8-18.el7 +3
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) python3-3.6.8-18.el7, python3-debug-3.6.8-18.el7, python3-devel-3.6.8-18.el7 +3
    • Red Hat Enterprise Linux Server (v. 7) python3-3.6.8-18.el7, python3-libs-3.6.8-18.el7, python3-libs-3.6.8-18.el7.ppc
    • Red Hat Enterprise Linux Server Optional (v. 7) python3-3.6.8-18.el7, python3-3.6.8-18.el7.ppc, python3-debug-3.6.8-18.el7 +9
    • Red Hat Enterprise Linux Workstation (v. 7) python3-3.6.8-18.el7, python3-libs-3.6.8-18.el7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) python3-3.6.8-18.el7, python3-debug-3.6.8-18.el7, python3-devel-3.6.8-18.el7 +3
  • RHSA-2020:4641 Released 2020-11-04 · Red Hat rating Moderate
    python38:3.8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.2.0+5234+f98739b6.src::python38:3.8, PyYAML-5.3.1-1.module+el8.3.0+7187+a27ec44b.src::python38:3.8, babel-2.7.0-10.module+el8.2.0+5234+f98739b6.src::python38:3.8 +47
  • RHSA-2020:4654 Released 2020-11-04 · Red Hat rating Moderate
    python27:2.7 security update
    • Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, PyYAML-3.12-16.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, babel-2.5.1-9.module+el8.1.0+3111+de3f2d8e.noarch::python27:2.7 +47
  • RHSA-2020:4433 Released 2020-11-04 · Red Hat rating Moderate
    python3 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-31.el8, platform-python-debug-3.6.8-31.el8, platform-python-devel-3.6.8-31.el8 +3
    • Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-31.el8, python3-3.6.8-31.el8, python3-libs-3.6.8-31.el8 +1
  • RHSA-2020:4299 Released 2020-10-20 · Red Hat rating Moderate
    rh-python38 security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python38-python-3.8.6-1.el7, rh-python38-python-debug-3.8.6-1.el7, rh-python38-python-devel-3.8.6-1.el7 +8
  • RHSA-2020:4273 Released 2020-10-20 · Red Hat rating Moderate
    python27 security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-python-2.7.18-2.el7, python27-python-debug-2.7.18-2.el7, python27-python-devel-2.7.18-2.el7 +6
  • RHSA-2020:4285 Released 2020-10-19 · Red Hat rating Moderate
    rh-python36 security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-python36-python-3.6.12-1.el6, rh-python36-python-debug-3.6.12-1.el6, rh-python36-python-devel-3.6.12-1.el6 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python36-python-3.6.12-1.el7, rh-python36-python-debug-3.6.12-1.el7, rh-python36-python-devel-3.6.12-1.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-python36-python-3.6.12-1.el7, rh-python36-python-debug-3.6.12-1.el7, rh-python36-python-devel-3.6.12-1.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python36-python-3.6.12-1.el7, rh-python36-python-debug-3.6.12-1.el7, rh-python36-python-devel-3.6.12-1.el7 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-python36-python-3.6.12-1.el6, rh-python36-python-debug-3.6.12-1.el6, rh-python36-python-devel-3.6.12-1.el6 +6
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python36-python-3.6.12-1.el7, rh-python36-python-debug-3.6.12-1.el7, rh-python36-python-devel-3.6.12-1.el7 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Quay 3AffectedNo fix yet
OpenShift Do 1Fixed RHSA-2021:0949
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4433, RHSA-2020:4641, RHSA-2020:4654
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2020:4433
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:5009, RHSA-2020:5010
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:5009, RHSA-2020:5010
Red Hat Enterprise Linux ComputeNode EUS (v. 7.6)Fixed RHSA-2021:0881
Red Hat Enterprise Linux ComputeNode EUS (v. 7.7)Fixed RHSA-2021:0528
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:5009, RHSA-2020:5010
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6)Fixed RHSA-2021:0881
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.7)Fixed RHSA-2021:0528
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:5009, RHSA-2020:5010
Red Hat Enterprise Linux Server AUS (v. 7.4)Fixed RHSA-2021:0761
Red Hat Enterprise Linux Server E4S (v. 7.4)Fixed RHSA-2021:0761
Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2021:0881
Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2021:0528
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2020:5009, RHSA-2020:5010
Red Hat Enterprise Linux Server Optional AUS (v. 7.4)Fixed RHSA-2021:0761
Red Hat Enterprise Linux Server Optional E4S (v. 7.4)Fixed RHSA-2021:0761
Red Hat Enterprise Linux Server Optional EUS (v. 7.6)Fixed RHSA-2021:0881
Red Hat Enterprise Linux Server Optional EUS (v. 7.7)Fixed RHSA-2021:0528
Red Hat Enterprise Linux Server Optional TUS (v. 7.4)Fixed RHSA-2021:0761
Red Hat Enterprise Linux Server TUS (v. 7.4)Fixed RHSA-2021:0761
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:5009, RHSA-2020:5010
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2020:5009, RHSA-2020:5010
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2021:0881
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2021:0881
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:4273, RHSA-2020:4285, RHSA-2020:4299
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:4273, RHSA-2020:4285, RHSA-2020:4299
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:4273, RHSA-2020:4285, RHSA-2020:4299
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2020:4285
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:4273, RHSA-2020:4285, RHSA-2020:4299
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-20907
  2. 2026-10-03 Alias added: GHSA-xc97-8p9q-cf27
  3. 2026-10-07 CVSS score added · CISA ADP
  4. 2026-10-07 Weakness changed · CISA ADP
  5. 2026-10-07 CISA SSVC decision points changed
  6. 2026-10-08 EPSS moved to the 50th–90th percentile
  7. 2026-10-09 Priority changed: MEDIUM → LOW

References

Patch 2

Advisory 24

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences