Steve Dower

On Windows, Python uses the `VPATH` variable to locate landmarks, such as 'Modules/setup.local', to determine if it is running in a source tree and adjust the default `sys.path`. In certain configurations, specifically with the legacy EXE installer, the `VPATH` value '....' results in a landmark path outside the installation directory. Because Windows may allow low-privilege users to create folders in the root directory of the OS drive, an attacker could create the landmark and an alternative `Lib` folder. This allows the restricted installation to discover and load unauthorized files, potentially leading to a privilege escalation.

Name of the Vulnerable Software and Affected Versions pymanager (affected versions not specified) Description pymanager included the current working directory in its `sys.path`, allowing modules in the current working directory to shadow intended packages. If a user runs a pymanager-generated command (like `pip` or `pytest`) from a directory controlled by an attacker, a malicious module in that directory could be imported and executed instead of the legitimate package. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A defect exists in the CPython “tarfile” module, impacting the “TarFile” extraction and entry enumeration APIs. The tar implementation processes tar archives with negative offsets without error, leading to an infinite loop and deadlock when parsing maliciously crafted tar archives.