William Woodruff

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.

**Name of the Vulnerable Software and Affected Versions** Python (affected versions not specified) **Description** When decompressing crafted zip files using bzip, LZMA, or Zstandard compressions, the software may use an attacker-controlled size to pre-allocate memory, which can lead to memory exhaustion. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GnuTLS versions prior to 3.8.3 **Description** A flaw in the GnuTLS library is related to shortcomings in handling exceptional states when analyzing the `cert list size` parameter in the `gnutls x509 trust list verify crt2()` function. This issue can be exploited by an attacker to cause a denial of service by passing a specially crafted certificate chain in PEM encoding to `certtool`. The vulnerability can also be triggered when verifying a specially crafted .pem bundle using the "certtool --verify-chain" command, potentially leading to an application crash. Remote attacks are possible, but no exploit has been reported yet. **Recommendations** For GnuTLS versions prior to 3.8.3, update GnuTLS immediately to prevent potential remote attacks. As a temporary workaround, consider restricting the use of the `certtool --verify-chain` command until a patch is applied. Avoid using the `certtool` command with untrusted .pem bundles to minimize the risk of exploitation.