CVE-2019-20907: Input Validation
A flaw was found in python. In Lib/tarfile.py an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation.
Other sources
In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because procpax lacks header validation.
Affected Software
Remediation
Information
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-20907?
CVE-2019-20907 is a vulnerability in Python that allows an attacker to craft a TAR archive leading to an infinite loop when opened by tarfile.open.
How severe is CVE-2019-20907?
CVE-2019-20907 has a severity score of 7.5, which is considered high.
Which versions of Python are affected by CVE-2019-20907?
Python versions 2.7.5 to 2.7.5-90.el7, 3.6.8 to 3.6.8-18.el7, and 3.8.0 to 3.8.3 are affected by CVE-2019-20907.
How can I fix CVE-2019-20907?
To fix CVE-2019-20907, update your Python version to 2.7.5-91.el7, 3.6.8-19.el7, or 3.8.4 or later.
Where can I find more information about CVE-2019-20907?
You can find more information about CVE-2019-20907 at the following references: [link 1], [link 2], [link 3].