Petr Viktorin

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** When decompressing crafted zip files using bzip, LZMA, or Zstandard compressions, the software may use an attacker-controlled size to pre-allocate memory, which can lead to memory exhaustion. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** In the `tarfile` module, the tar and data extraction filters allow the creation of empty directories outside the intended destination on POSIX platforms. This occurs when a member name leaves the destination and subsequently returns to it, such as `../evil/../dest/sub/file`. While the containment check utilizes the resolved path, intermediate directories are created based on the provided name. Member contents remain extracted within the destination. This issue does not affect Windows because `..` components are collapsed before reaching the filesystem. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `stringprep` module incorrectly processes characters from RFC 3454 tables B.2 or B.3 by using the latest Unicode codepoint attributes instead of the required Unicode 3.2.0. This leads to mismatches when processing domain names via the `idna` codec (IDNA 2003) and the `in table b2()` function. The issue specifically impacts domain names containing characters that were either not registered or had their Unicode attributes, such as case-folding behavior, updated after Unicode 3.2.0. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** Certain functions exhibit quadratic time complexity, denoted as `O(n^2)`, when processing XML documents containing numerous siblings with the same tag. This occurs specifically when using XPath index predicates such as `[1]`, `[last()]`, or `[last()-N]`. The affected functions include `Element.findall()` and fully-consumed `Element.iterfind()`. Additionally, `Element.find()` is impacted when the first match is located near the end of the sibling list, such as when using `[last()]` or `[last()-N]`, although `.//item[1]` short-circuits after the first match. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** In the `extract()` function of the Tarfile module, the `filter` parameter is not correctly handled when extracting hardlinks. This issue allows a system extracting content from untrusted tar files to write files with an unexpected uid/gid, even when the user has specified `filter='data'` to restrict the extraction process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python tarfile (affected versions not specified) **Description** A flaw exists in the `extractall()` function when using the 'data' or 'tar' filters. A specially crafted archive containing a hardlink that references a symlink stored at a deeper path can bypass these filters. The extraction process validates the symlink at its original archived location but recreates it at the shallower path of the hardlink. This allows a relative target to escape the destination directory, enabling a malicious archive to create symlinks that point outside the intended folder, which can lead to unauthorized file reads or writes outside the destination. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** When using the `configparser` module to write configuration files containing multi-line text values with carriage return characters (r), the resulting file could be injected with unexpected keys and values if an attacker controls the written value. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `tarfile` module fails to properly handle the End of File (EOF) when a file is opened in streaming mode (mode="r|"). This can lead to a situation where an archive is parsed in an infinite loop. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `tarfile.data filter` can be bypassed using crafted link entries, such as symlinks with empty or directory-like names. This allows a malicious tar archive to redirect subsequent archive members outside the intended extraction directory, causing the `tarfile.extractall()` function to write files to arbitrary locations on the system, depending on the permissions of the process performing the extraction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `unicodedata.normalize()` function can consume excessive CPU time when processing specially crafted Unicode input. This occurs when the input contains long sequences of combining characters with alternating Canonical Combining Class values, affecting all normalization forms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python email module (affected versions not specified) **Description** The `BytesGenerator` class within the email module did not correctly quote newlines for email headers during email message serialization. This flaw allows for header injection when an email is serialized, specifically when using "LiteralHeader" writing headers that do not adhere to email folding rules. The updated behavior rejects incorrectly folded headers in `BytesGenerator`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python versions 3.12 through 3.13 **Description** An issue exists in the `tarfile` module when extracting untrusted tar archives. When using the `TarFile.extractall()` or `TarFile.extract()` functions with the `filter` parameter set to `data` or `tar`, it is possible to modify file metadata (such as last modified time) or file permissions (chmod) for files located outside the intended extraction directory. In Python 3.14 and later, the default value of the `filter` parameter changed to `data`, making users who rely on this default behavior susceptible to the issue. This can lead to arbitrary file modification on the system and potential data loss. **Recommendations** Update Python 3.12 to version 3.12.7-1ubuntu2.2 or later. Update Python 3.13 to version 3.13.0-1ubuntu0.3 or later. As a temporary workaround, avoid using the `filter` parameter with values `data` or `tar` when extracting untrusted archives using `TarFile.extractall()` or `TarFile.extract()`.

**Name of the Vulnerable Software and Affected Versions** Python versions 3.12 through 3.13 **Description** An issue in the `tarfile` module allows the extraction filter to be ignored when extracting untrusted tar archives. This can enable an attacker to create symbolic links that point outside the destination directory, modify file metadata, and potentially modify files in arbitrary filesystem locations, leading to data loss or unauthorized access to protected information. The issue occurs when using the `TarFile.extractall()` or `TarFile.extract()` functions with the `filter` parameter set to `data` or `tar`. For Python versions 3.14 and later, the default value of the `filter` parameter is `data`, making usage relying on this default behavior also susceptible. **Recommendations** Update Python 3.12 to version 3.12.7-1ubuntu2.2. Update Python 3.13 to version 3.13.0-1ubuntu0.3. Avoid using the `filter` parameter with values `data` or `tar` when extracting untrusted archives. Avoid installing source distributions containing suspicious links.

**Name of the Vulnerable Software and Affected Versions** python3.12 versions prior to 3.12.7-1ubuntu2.2 python3.13 versions prior to 3.13.0-1ubuntu0.3 **Description** Python incorrectly handles tar archive extraction when using the filtering option. Specifically, when `TarFile.errorlevel` is set to `0` during extraction with a filter, the system fails to skip filtered members as documented, extracting them instead. This issue could allow a remote attacker to modify files in arbitrary filesystem locations, potentially leading to data loss or compromising the integrity of protected information. **Recommendations** Update python3.12 to version 3.12.7-1ubuntu2.2. Update python3.13 to version 3.13.0-1ubuntu0.3.

**Name of the Vulnerable Software and Affected Versions** Python versions 3.12 and later **Description** The issue allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory and the modification of some file metadata. This affects users who utilize the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() with the filter parameter set to "data" or "tar". For Python 3.14 and later, the default filter value changed to "data", which also affects usage relying on this new default behavior. The installation of source distributions, which are tar archives, is not significantly affected as they already allow arbitrary code execution during the build process. **Recommendations** For Python versions 3.12 and later, consider updating to a version where this issue is fixed, although the specific fixed version is not provided. As a temporary workaround, avoid using the filter parameter with values of "data" or "tar" when extracting untrusted tar archives with TarFile.extractall() or TarFile.extract() until a patch is available. Restrict access to untrusted tar archives to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Python versions 3.12 through 3.13 **Description** An issue in the `tarfile` module allows arbitrary filesystem writes outside the extraction directory when extracting untrusted tar archives. This occurs when using the `TarFile.extractall()` or `TarFile.extract()` functions with the `filter` parameter set to `data` or `tar`. For Python 3.14 and later, the default value of `filter` changed to `data`, making usage relying on this default behavior also susceptible. An attacker could exploit this to modify files in arbitrary locations, cause data loss, or potentially achieve privilege escalation or container escape if the scripts are executed with root privileges. **Recommendations** Update Python 3.12 to version 3.12.11 or later. Update Python 3.13 to version 3.13.4 or later. As a temporary workaround, avoid using the `filter` parameter with values `data` or `tar` when extracting untrusted archives.

**Name of the Vulnerable Software and Affected Versions** CPython (affected versions not specified) **Description** The issue concerns the email module in CPython, which did not properly quote newlines for email headers when serializing an email message. This allows for header injection when an email is serialized, potentially enabling a remote authenticated attacker to spoof sender identity, gain unauthorized email sending, or cause loss of control over email communication by persuading a victim to open a specially crafted email. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.