Stan Ulbrych

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** In the `tarfile` module, the tar and data extraction filters allow the creation of empty directories outside the intended destination on POSIX platforms. This occurs when a member name leaves the destination and subsequently returns to it, such as `../evil/../dest/sub/file`. While the containment check utilizes the resolved path, intermediate directories are created based on the provided name. Member contents remain extracted within the destination. This issue does not affect Windows because `..` components are collapsed before reaching the filesystem. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `stringprep` module incorrectly processes characters from RFC 3454 tables B.2 or B.3 by using the latest Unicode codepoint attributes instead of the required Unicode 3.2.0. This leads to mismatches when processing domain names via the `idna` codec (IDNA 2003) and the `in table b2()` function. The issue specifically impacts domain names containing characters that were either not registered or had their Unicode attributes, such as case-folding behavior, updated after Unicode 3.2.0. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `tarfile` module fails to properly handle the End of File (EOF) when a file is opened in streaming mode (mode="r|"). This can lead to a situation where an archive is parsed in an infinite loop. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python tarfile (affected versions not specified) **Description** A flaw exists in the `extractall()` function when using the 'data' or 'tar' filters. A specially crafted archive containing a hardlink that references a symlink stored at a deeper path can bypass these filters. The extraction process validates the symlink at its original archived location but recreates it at the shallower path of the hardlink. This allows a relative target to escape the destination directory, enabling a malicious archive to create symlinks that point outside the intended folder, which can lead to unauthorized file reads or writes outside the destination. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** `bz2.BZ2Decompressor` objects can be reused following a decompression error. If an application catches the resulting `OSError` and attempts to retry using the same decompressor, specially crafted input may cause the decompressor to resume from an invalid internal state. This leads to out-of-bounds writes to a stack buffer, which can result in a process crash when processing untrusted data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `tarfile.data filter` can be bypassed using crafted link entries, such as symlinks with empty or directory-like names. This allows a malicious tar archive to redirect subsequent archive members outside the intended extraction directory, causing the `tarfile.extractall()` function to write files to arbitrary locations on the system, depending on the permissions of the process performing the extraction. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `unicodedata.normalize()` function can consume excessive CPU time when processing specially crafted Unicode input. This occurs when the input contains long sequences of combining characters with alternating Canonical Combining Class values, affecting all normalization forms. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** The `xml.parsers.expat` and `xml.etree.ElementTree` modules use insufficient entropy for Expat hash-flooding protection. This allows a specially crafted XML document to trigger hash flooding, a condition where many keys are mapped to the same hash bucket, significantly slowing down processing. **Recommendations** Update libexpat to version 2.8.0 or later and apply the available software patch.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An incomplete mitigation allows for a bypass when a URL contains the string "%action". For certain browser types, this can lead to command injection into the underlying shell via the `webbrowser.open()` function. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** A use-after-free flaw exists in the decompression modules of Python, specifically within `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This issue occurs when a program re-uses a decompression object after a `MemoryError` is raised due to memory allocation failure, typically during periods of high memory pressure. A use-after-free is a condition where a program continues to use a pointer after it has been freed, which can lead to memory corruption. Exploitation of this flaw could allow an attacker to execute arbitrary code or access sensitive data. The issue is not present when using one-shot decompression helper functions such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()`, as these create a new instance for every call. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, avoid re-using decompressor instances across multiple calls if a `MemoryError` has occurred.

**Name of the Vulnerable Software and Affected Versions** http.cookies (affected versions not specified) **Description** An incomplete fix for a previous issue related to control character validation in `http.cookies.Morsel` allows control characters to bypass input validation. The fix did not fully address the problem, leaving the `Morsel.update()`, `|= operator`, and unpickling paths vulnerable. Additionally, the `BaseCookie.js output()` function lacks the output validation present in `BaseCookie.output()`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Expat (affected versions not specified) **Description** The Expat parser, when used with a registered ElementDeclHandler, is susceptible to a C stack overflow when processing an inline document type definition with a deeply nested content model. This occurs during the parsing of XML documents containing complex and deeply nested DTD content models. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.