CVE-2024-12718

Name of the Vulnerable Software and Affected Versions Python versions 3.12 through 3.13

Description An issue exists in the tarfile module when extracting untrusted tar archives. When using the TarFile.extractall() or TarFile.extract() functions with the filter parameter set to data or tar, it is possible to modify file metadata (such as last modified time) or file permissions (chmod) for files located outside the intended extraction directory. In Python 3.14 and later, the default value of the filter parameter changed to data, making users who rely on this default behavior susceptible to the issue. This can lead to arbitrary file modification on the system and potential data loss.

Recommendations Update Python 3.12 to version 3.12.7-1ubuntu2.2 or later. Update Python 3.13 to version 3.13.0-1ubuntu0.3 or later. As a temporary workaround, avoid using the filter parameter with values data or tar when extracting untrusted archives using TarFile.extractall() or TarFile.extract().