CVE-2025-13462: tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling
tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling
Other sources
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13462?
CVE-2025-13462 is considered a moderate severity vulnerability, primarily affecting the tarfile module in Python.
How do I fix CVE-2025-13462?
To address CVE-2025-13462, ensure you update the tarfile module to the latest patch version as recommended by Python developers.
What software does CVE-2025-13462 affect?
CVE-2025-13462 affects the tarfile module found in Python's standard library.
What kind of attacks can CVE-2025-13462 lead to?
CVE-2025-13462 could potentially allow attackers to exploit crafted tar archives, leading to unexpected behavior or security issues.
Is CVE-2025-13462 exploitable in all versions of tarfile?
CVE-2025-13462 is specifically exploitable in versions of the tarfile module prior to the release containing the fix.