Описание
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
A flaw was found in the tarfile.data_filter function within the Python tarfile module. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive containing malicious link entries, such as symlinks with empty or directory-like names. This bypass allows the attacker to redirect subsequent archive members outside the intended extraction directory, leading to arbitrary file writes on the system where the archive is extracted. The impact of this flaw is limited by the permissions of the extracting process.
Отчет
The CPython tarfile module is susceptible to arbitrary file writes when processing a specially crafted archive containing malicious link entries. Exploitation requires user interaction to extract the archive, and the impact is constrained by the permissions of the extracting process, limiting the scope of potential data integrity compromise.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Exploit Intelligence | exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | python3.12 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | python3.14 | Not affected | ||
| Red Hat Enterprise Linux 6 | python | Fix deferred | ||
| Red Hat Enterprise Linux 7 | python | Fix deferred | ||
| Red Hat Enterprise Linux 7 | python3 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python3 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python3.12 | Not affected | ||
| Red Hat Enterprise Linux 8 | python36 | Fix deferred | ||
| Red Hat Enterprise Linux 8 | python36:3.6/python36 | Fix deferred |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
6.5 Medium
CVSS3
Связанные уязвимости
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() to write files outside the destination directory, subject to the permissions of the extracting process.
tarfile.data_filter path traversal bypass allows writing outside the extraction directory
tarfile.data_filter could be bypassed using crafted link entries, incl ...
6.5 Medium
CVSS3