Ethan Furman

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** In the `tarfile` module, the tar and data extraction filters allow the creation of empty directories outside the intended destination on POSIX platforms. This occurs when a member name leaves the destination and subsequently returns to it, such as `../evil/../dest/sub/file`. While the containment check utilizes the resolved path, intermediate directories are created based on the provided name. Member contents remain extracted within the destination. This issue does not affect Windows because `..` components are collapsed before reaching the filesystem. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CPython versions (affected versions not specified) **Description** A defect exists in the CPython “tarfile” module, impacting the “TarFile” extraction and entry enumeration APIs. The tar implementation processes tar archives with negative offsets without error, leading to an infinite loop and deadlock when parsing maliciously crafted tar archives. **Recommendations** Include the following patch after importing the “tarfile” module: ```python import tarfile def block patched(self, count): if count < 0: # pragma: no cover raise tarfile.InvalidHeaderError("invalid offset") return block patched. orig block(self, count) block patched. orig block = tarfile.TarInfo. block tarfile.TarInfo. block = block patched ```