Описание
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
A flaw was found in the Python tarfile module. When processing a specially crafted tar archive opened in 'streaming mode' (mode='r|'), the module does not properly handle the end-of-file (EOF) condition. This can cause the tarfile module to enter an infinite loop, leading to a Denial of Service (DoS) for applications processing such archives.
Отчет
A flaw was found in the Python tarfile module. When processing a tar archive in streaming mode (mode='r|'), the _Stream.seek function does not properly check for end-of-file, which can cause an infinite loop when processing a specially crafted archive. Red Hat ships Python as part of many products, and applications using tarfile's streaming mode are potentially affected by this denial of service vulnerability.
Меры по смягчению последствий
Avoid using tarfile streaming mode (mode='r|') with untrusted tar archives. Use the standard file-based mode (mode='r') instead where possible.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaii/model-opt-cuda-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/model-opt-cuda-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-cpu-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-cuda-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-neuron-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-rocm-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-spyre-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaiis/vllm-tpu-rhel9 | Fix deferred | ||
| Red Hat AI Inference Server | rhaii/vllm-cpu-rhel9 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, making archive parsing take exponentially longer.
When using the "tarfile" module with a file opened in "streaming mode" ...
When using the "tarfile" module with a file opened in "streaming mode" (mode="r|") the tarfile module did not properly handle EOF, meaning an archive could be parsed in an infinite loop.
EPSS
6.5 Medium
CVSS3